@popoverai/dotrequirements 0.26.1 → 0.27.0

package/dist/schema/parser.js

@@ -1,245 +1,53 @@
 /**
  * Parse Markdown requirements files into typed structures.
+ *
+ * File-level concerns only: frontmatter isolation, metadata validation, and
+ * disk IO. All block and criterion parsing delegates to the
+ * environment-agnostic parser-core module, which the web editor and Convex
+ * also consume — one parser, so the CLI and the cloud cannot drift on what a
+ * requirements file means (SYNC-FORMAT-2.3).
  */
 import * as fs from "node:fs";
 import YAML from "yaml";
-import { ValidationError, validateKey, validateMetadata, } from "./schemas.js";
-const DELIMITER_PATTERN = "(?:→|->)"; // Non-capturing group for both Unicode and ASCII
-/**
- * Parse a criterion line in "position. Label → content" format.
- * Example: "0. Given → user has valid credentials"
- * Also supports optional label: "0. → user has valid credentials"
- */
-export function parseCriterionLine(line, delimiter = DELIMITER_PATTERN) {
-    // Match: position + period + space + optional(label + space) + delimiter + space + content
-    // Position can be: 0, 1.0, 2.3.1, etc.
-    // Label can contain any characters except the delimiter
-    const pattern = new RegExp(`^\\s*(\\d+(?:\\.\\d+)*)\\.\\s*(?:(.+?)\\s+)?${delimiter}\\s*(.+)$`);
-    const match = line.match(pattern);
-    if (!match) {
-        return null;
-    }
-    return {
-        position: match[1],
-        label: match[2] ? match[2].trim() : "", // Preserve original case, empty if no label
-        content: match[3].trim(),
-    };
-}
-/**
- * Parse the first line of a dotrequirements block (the root requirement).
- * Format: "KEY: content" or "Label → content" or "→ content"
- */
-function parseRootLine(line, delimiter = DELIMITER_PATTERN) {
-    const trimmed = line.trim();
-    // Try to match: KEY + colon + content (explicit key format)
-    // KEY must be followed by colon (not arrow) to distinguish from "Label → content"
-    const keyMatch = trimmed.match(/^([\w-]+):\s*(.+)$/);
-    if (keyMatch) {
-        return {
-            label: "", // Keys use empty string for unlabeled requirements
-            content: keyMatch[2].trim(),
-        };
-    }
-    // Match: optional(label + space) + delimiter + space + content
-    const pattern = new RegExp(`^(?:(.+?)\\s+)?${delimiter}\\s*(.+)$`);
-    const match = trimmed.match(pattern);
-    if (!match) {
-        // If no delimiter found, treat entire line as content with empty label
-        return {
-            label: "",
-            content: trimmed,
-        };
-    }
-    return {
-        label: match[1] ? match[1].trim() : "",
-        content: match[2].trim(),
-    };
-}
-/**
- * Parse a dotrequirements fenced block into a RequirementNode tree.
- * First line is the requirement content (with optional arrow format).
- * Subsequent lines are criteria with position paths.
- */
-export function parseRequirementBlock(key, blockContent) {
-    const lines = blockContent.trim().split("\n");
-    if (lines.length === 0) {
-        throw new ValidationError("Empty requirement block", key);
-    }
-    // First line is the requirement content
-    const rootParsed = parseRootLine(lines[0]);
-    if (!rootParsed.content) {
-        throw new ValidationError("Requirement content (first line) cannot be empty", key);
-    }
-    const root = {
-        id: key,
-        // Root requirements always use "requirementHeader" label for indexing/querying
-        // The markdown format doesn't preserve root labels, but we standardize on this value
-        label: "requirementHeader",
-        content: rootParsed.content,
-        children: [],
-    };
-    // Parse criteria lines
-    const criteriaByPosition = new Map();
-    for (let i = 1; i < lines.length; i++) {
-        const line = lines[i];
-        // Skip empty lines and comments
-        if (!line.trim() || line.trim().startsWith("#")) {
-            continue;
-        }
-        const criterion = parseCriterionLine(line);
-        if (!criterion) {
-            throw new ValidationError(`Invalid criterion format at line ${i + 1}: "${line.trim()}"`, key);
-        }
-        criteriaByPosition.set(criterion.position, criterion);
-    }
-    // Build tree from flat position paths
-    buildTreeFromPositions(root, key, criteriaByPosition);
-    return root;
-}
-/**
- * Build a tree structure from flat position paths.
- * Positions like "0", "1", "1.0", "1.1", "1.1.0" define the hierarchy.
- */
-function buildTreeFromPositions(root, rootKey, criteriaByPosition) {
-    // Get all top-level children (single digit positions: "0", "1", "2")
-    const topLevelPositions = Array.from(criteriaByPosition.keys())
-        .filter((pos) => !pos.includes("."))
-        .sort((a, b) => parseInt(a, 10) - parseInt(b, 10));
-    for (const position of topLevelPositions) {
-        const criterion = criteriaByPosition.get(position);
-        const childNode = {
-            id: `${rootKey}.${position}`,
-            label: criterion.label,
-            content: criterion.content,
-            children: [],
-        };
-        // Recursively build children
-        buildChildrenFromPositions(childNode, position, rootKey, criteriaByPosition);
-        root.children.push(childNode);
-    }
-}
-/**
- * Recursively build children for a given position.
- */
-function buildChildrenFromPositions(parent, parentPosition, rootKey, criteriaByPosition) {
-    // Find direct children (e.g., if parent is "1", find "1.0", "1.1", etc.)
-    const childPositions = Array.from(criteriaByPosition.keys())
-        .filter((pos) => {
-        const parts = pos.split(".");
-        const parentParts = parentPosition.split(".");
-        // Must be exactly one level deeper
-        if (parts.length !== parentParts.length + 1) {
-            return false;
-        }
-        // All parent parts must match
-        for (let i = 0; i < parentParts.length; i++) {
-            if (parts[i] !== parentParts[i]) {
-                return false;
-            }
-        }
-        return true;
-    })
-        .sort((a, b) => {
-        const aLast = parseInt(a.split(".").pop(), 10);
-        const bLast = parseInt(b.split(".").pop(), 10);
-        return aLast - bLast;
-    });
-    for (const position of childPositions) {
-        const criterion = criteriaByPosition.get(position);
-        const childNode = {
-            id: `${rootKey}.${position}`,
-            label: criterion.label,
-            content: criterion.content,
-            children: [],
-        };
-        // Recursively build grandchildren
-        buildChildrenFromPositions(childNode, position, rootKey, criteriaByPosition);
-        parent.children.push(childNode);
-    }
-}
+import { parseRequirementBlocksFromMarkdown, splitFrontmatter, } from "./parser-core.js";
+import { ValidationError, validateMetadata, } from "./schemas.js";
+// Block/criterion parsing and tree utilities live in parser-core; re-exported
+// here so the schema module's public surface is unchanged.
+export { findRequirementById, flattenRequirementTree, getAllRequirements, parseCriterionLine, parseRequirementBlock, } from "./parser-core.js";
 /**
  * Extract YAML frontmatter from Markdown content.
  * Returns { frontmatter, body } where frontmatter is the parsed YAML object.
  */
 function extractFrontmatter(content) {
-    // Match YAML frontmatter: ---\n...\n---
-    const frontmatterRegex = /^---\n([\s\S]*?)\n---\n([\s\S]*)$/;
-    const match = content.match(frontmatterRegex);
-    if (!match) {
+    // Single fence match: yaml and body come from the same split, so they can
+    // never disagree about where the frontmatter closes.
+    const split = splitFrontmatter(content);
+    if (split === undefined) {
         throw new ValidationError("Missing YAML frontmatter (should start with ---)");
     }
-    const [, frontmatterYaml, body] = match;
     let frontmatter;
     try {
-        frontmatter = YAML.parse(frontmatterYaml);
+        frontmatter = YAML.parse(split.yaml);
     }
     catch (error) {
         throw new ValidationError("Failed to parse YAML frontmatter", undefined, error);
     }
-    return { frontmatter, body: body.trim() };
-}
-/**
- * Extract requirement blocks from Markdown body.
- * Returns a map of requirement key -> { title, blockContent }
- *
- * The KEY is extracted from the first line inside the code block.
- * Headings are optional and only used for human readability.
- */
-function extractRequirementBlocks(body) {
-    const blocks = new Map();
-    // Find all ```dotrequirements code blocks
-    const blockRegex = /```dotrequirements\n([\s\S]*?)```/gm;
-    let match = blockRegex.exec(body);
-    while (match !== null) {
-        const blockContent = match[1];
-        // Extract key from first line of block (format: "KEY: content")
-        const firstLineMatch = blockContent.match(/^([\w-]+):\s*(.+)/);
-        if (!firstLineMatch) {
-            throw new ValidationError(`Invalid requirement block format - first line must be "KEY: content"`, blockContent.substring(0, 50));
-        }
-        const key = firstLineMatch[1];
-        // SYNC-KEY-1: reject malformed keys at parse time so push/validate fail
-        // locally instead of erroring server-side. Validation only — the original
-        // key is preserved (normalization happens downstream).
-        validateKey(key);
-        // Try to find a heading immediately before this block for the title
-        // Look backwards from the match position to find the nearest heading
-        const textBeforeBlock = body.substring(0, match.index);
-        const headingMatch = textBeforeBlock.match(/^#{2,6}\s+([^\n]+)\s*$/m);
-        const title = headingMatch ? headingMatch[1].trim() : key;
-        blocks.set(key, { title, blockContent: blockContent.trim() });
-        match = blockRegex.exec(body);
-    }
-    return blocks;
+    return { frontmatter, body: split.body.trim() };
 }
 /**
  * Parse a complete requirements Markdown file.
  */
 export function parseRequirementsFile(markdownContent) {
-    // Extract frontmatter and body
+    // CRLF normalization (SYNC-FORMAT-1) happens inside the shared parser-core
+    // helpers (splitFrontmatter / parseRequirementBlocksFromMarkdown), so every
+    // entry point agrees.
     const { frontmatter, body } = extractFrontmatter(markdownContent);
-    // Validate metadata from frontmatter
     const metadata = validateMetadata(frontmatter);
-    // Extract requirement blocks
-    const blocks = extractRequirementBlocks(body);
-    if (blocks.size === 0) {
+    const requirements = parseRequirementBlocksFromMarkdown(body);
+    if (requirements.length === 0) {
         throw new ValidationError("No requirement blocks found in document");
     }
-    // Parse each requirement block
-    const requirements = [];
-    for (const [key, { blockContent }] of blocks) {
-        try {
-            const reqNode = parseRequirementBlock(key, blockContent);
-            requirements.push(reqNode);
-        }
-        catch (error) {
-            throw new ValidationError(`Failed to parse requirement ${key}`, key, error);
-        }
-    }
-    return {
-        metadata,
-        requirements,
-    };
+    return { metadata, requirements };
 }
 /**
  * Parse requirements file from disk.
@@ -256,40 +64,4 @@ export function parseRequirementsFromFile(filePath) {
         throw new ValidationError(`Failed to read file: ${filePath}`, undefined, error);
     }
 }
-/**
- * Flatten a requirement tree into a list of all nodes.
- * Useful for searching or displaying all requirements.
- */
-export function flattenRequirementTree(node) {
-    const result = [node];
-    for (const child of node.children) {
-        result.push(...flattenRequirementTree(child));
-    }
-    return result;
-}
-/**
- * Find a requirement by its ID in a tree.
- */
-export function findRequirementById(nodes, id) {
-    for (const node of nodes) {
-        if (node.id === id) {
-            return node;
-        }
-        const found = findRequirementById(node.children, id);
-        if (found) {
-            return found;
-        }
-    }
-    return undefined;
-}
-/**
- * Get all requirements from multiple files as a flat list.
- */
-export function getAllRequirements(requirements) {
-    const all = [];
-    for (const req of requirements) {
-        all.push(...flattenRequirementTree(req));
-    }
-    return all;
-}
 //# sourceMappingURL=parser.js.map

package/dist/schema/resolver.js

@@ -16,7 +16,9 @@ export function parseRequirementPath(path) {
  * E.g., "given#2" → { label: "given", index: 2 }
  */
 export function parsePathSegment(segment) {
-    const match = segment.match(/^(\w+)(?:#(\d+))?$/);
+    // HARNESS-RESOLVE-2.0: multi-word labels are addressed by their kebab-case
+    // form (e.g. "Edge Case" → "edge-case"), so segments may contain hyphens.
+    const match = segment.match(/^([\w-]+)(?:#(\d+))?$/);
     if (!match) {
         throw new Error(`Invalid path segment: ${segment}`);
     }
@@ -47,10 +49,18 @@ export function findChildrenByLabel(node, label) {
  * Returns the child node and its numeric index.
  */
 export function resolvePathSegment(node, segment) {
-    // Check if segment is numeric (direct index)
+    // Check if segment is numeric (written position)
+    // HARNESS-RESOLVE-1: a numeric segment means the position written in the
+    // file, not the array index. Node ids preserve written positions (which may
+    // have gaps), so match the child whose id's last position segment equals
+    // the requested position. When no child was written at that position,
+    // resolution fails rather than binding to a neighboring criterion.
     if (/^\d+$/.test(segment)) {
-        const index = parseInt(segment, 10);
-        if (index < node.children.length) {
+        const index = node.children.findIndex((child) => {
+            const lastDot = child.id.lastIndexOf(".");
+            return child.id.slice(lastDot + 1) === segment;
+        });
+        if (index !== -1) {
             return {
                 child: node.children[index],
                 index,
@@ -158,13 +168,13 @@ export function checkPathAmbiguity(requirements, path) {
     // Check each segment for ambiguity
     for (let i = 1; i < segments.length; i++) {
         const segment = segments[i];
-        // Numeric segments are never ambiguous
+        // Numeric segments are never ambiguous (resolved by written position)
         if (/^\d+$/.test(segment)) {
-            const index = parseInt(segment, 10);
-            if (index >= currentNode.children.length) {
+            const resolved = resolvePathSegment(currentNode, segment);
+            if (!resolved) {
                 return 0; // Invalid path
             }
-            currentNode = currentNode.children[index];
+            currentNode = resolved.child;
             continue;
         }
         // Check for label disambiguation (#N)

package/dist/templates/context-file-section.md

@@ -10,13 +10,14 @@ requirements, so your plan should too.
 
 **ALWAYS follow this workflow when changing system behavior** (new features, bug fixes, any behavioral change). Only pure refactoring (same behavior, different code) may skip requirements.
 
-1. **Find or write requirements** - Check `.requirements/` for existing specs; write new ones if needed
-2. **Style-check** - Run `mcp__dotrequirements__style_check` on the file
-3. **Get approval** - Present requirements, wait for go-ahead
-4. **Implement** - Build the feature
-5. **Write tests** - Reference requirements with `requirement()`
-6. **Run tests** - Verify everything passes
-7. **Review tests** - Run `mcp__dotrequirements__review_test` to validate coverage
+1. **Find or write requirements** - Check `.requirements/` for existing specs (`dotreq search`, `dotreq get`, `dotreq list`); write new ones if needed (`dotreq create-requirement-document` prints the template and style guide)
+2. **Style-review** - Dispatch a subagent to run `dotreq style-check <file>` and judge the requirements against the style guide it emits. If this platform cannot dispatch subagents, run the command and perform the review in this conversation.
+3. **Validate** - Run `dotreq validate` to check syntax
+4. **Get approval** - Present requirements, wait for go-ahead
+5. **Implement** - Build the feature
+6. **Write tests** - Reference requirements with `requirement()`
+7. **Run tests** - Verify everything passes
+8. **Test-review** - Dispatch a subagent to run `dotreq review-test <test-file>` and judge the tests against the materials it emits. Same fallback: no subagent support, review in this conversation.
 
 ### Requirements Syntax
 
@@ -31,7 +32,7 @@ DOMAIN-1: Short description of expected behavior
 - Criteria: `position. -> content` (optional label before the arrow)
 - Nesting: Indent with 2 spaces, use `x.y` position paths
 - Delimiter: `->` or `→`
-- **Key style**: Use sequential keys with a short domain prefix (`ORCHESTRATOR-1`, `ORCHESTRATOR-2`, ...) rather than semantic keys (`AUTONOMOUS-ADVANCE`). Sequential keys stay stable when a requirement gets reworded, so test references don't break. Call `create_requirement_document` for full key-naming guidance.
+- **Key style**: Use sequential keys with a short domain prefix (`ORCHESTRATOR-1`, `ORCHESTRATOR-2`, ...) rather than semantic keys (`AUTONOMOUS-ADVANCE`). Sequential keys stay stable when a requirement gets reworded, so test references don't break. Run `dotreq create-requirement-document` for full key-naming guidance.
 
 ### Test Usage
 
@@ -44,21 +45,23 @@ test(requirement('REQ-ID'), () => { /* test the requirement */ });
 test(requirement('REQ-ID.0'), () => { /* test specific criterion */ });
 ```
 
-### MCP Tools
+### CLI Verbs
 
 **Exploration:**
-- `list_requirements` - Overview of all requirements (set `untested: true` to filter to coverage gaps)
-- `get_requirement` - Requirement tree with test coverage
-- `search_requirements` - Search by text/regex
+- `dotreq list [--untested]` - Overview of all requirements (`--untested` filters to coverage gaps)
+- `dotreq get <id>` - Requirement tree with test coverage
+- `dotreq search <query> [--regex]` - Search by text/regex
+- `dotreq requirements-for <test-file>` - See requirements a test file covers
+- `dotreq tests-for <req-file>` - See test coverage for a requirements file
 
 **Authoring:**
-- `create_requirement_document` - Get template with format guidance
-- `validate_requirements` - Check syntax (works offline)
-- `style_check` - AI feedback on clarity
-- `push_requirements` - Sync to cloud
-
-**Testing:**
-- `get_requirements_by_test` - See requirements a test file covers
-- `list_requirements` (with `untested: true`) - Find requirements without tests
-- `report_coverage` - Get test coverage from local cache or cloud
-- `review_test` - Validate tests match requirement intent
+- `dotreq create-requirement-document [path]` - Print the template and style guide
+- `dotreq validate [glob]` - Check syntax (works offline)
+- `dotreq push [file]` - Sync to cloud (shows diff preview, then confirms)
+
+**Review (judgment runs in the dispatched subagent):**
+- `dotreq style-check <file>` - Emits the style guide + content for the reviewer to judge (`--source cloud` for hosted review)
+- `dotreq review-test <test-file>` - Emits referenced requirement trees + test content for the reviewer to judge (`--source cloud` for hosted review)
+
+**Coverage:**
+- `dotreq report [--source local|cloud]` - Test coverage report

package/dist/utils/context-file.d.ts

@@ -3,7 +3,11 @@
  */
 export declare function getContextFileName(platform: string): string | null;
 /**
- * Find the git root directory
+ * Find the git root directory.
+ *
+ * CONTEXT-FILE-6: in a worktree, .git is a FILE pointing at the main
+ * checkout — matching directories only would walk past it and resolve to
+ * the main checkout's root, landing the context file in the wrong tree.
  */
 export declare function findGitRoot(): Promise<string | null>;
 /**
@@ -39,8 +43,8 @@ export declare function getContextFilePath(platform: string): Promise<string | n
  * Build a user-facing message explaining that context file installation
  * was skipped because the current directory is not inside a git repository.
  *
- * The MCP server itself is configured separately, so this message is only
- * about the second step (writing the platform's context file).
+ * Writing the platform's context file is the whole of setup now, so a missing
+ * git root means nothing was installed.
  */
 export declare function buildNoGitRepoMessage(fileName: string): string;
 //# sourceMappingURL=context-file.d.ts.map

package/dist/utils/context-file.js

@@ -11,7 +11,8 @@ const PLATFORM_CONTEXT_FILES = {
     cursor: "AGENTS.md",
     codex: "AGENTS.md",
     "github-copilot": "AGENTS.md",
-    antigravity: "GEMINI.md",
+    // Antigravity 2.0 retired the GEMINI.md/.gemini conventions for AGENTS.md
+    antigravity: "AGENTS.md",
 };
 /**
  * Get the appropriate context file name for a platform
@@ -20,10 +21,14 @@ export function getContextFileName(platform) {
     return PLATFORM_CONTEXT_FILES[platform] ?? null;
 }
 /**
- * Find the git root directory
+ * Find the git root directory.
+ *
+ * CONTEXT-FILE-6: in a worktree, .git is a FILE pointing at the main
+ * checkout — matching directories only would walk past it and resolve to
+ * the main checkout's root, landing the context file in the wrong tree.
  */
 export async function findGitRoot() {
-    const gitDir = await findUp(".git", { type: "directory" });
+    const gitDir = await findUp(".git", { type: "both" });
     return gitDir ? dirname(gitDir) : null;
 }
 /**
@@ -95,8 +100,8 @@ export async function getContextFilePath(platform) {
  * Build a user-facing message explaining that context file installation
  * was skipped because the current directory is not inside a git repository.
  *
- * The MCP server itself is configured separately, so this message is only
- * about the second step (writing the platform's context file).
+ * Writing the platform's context file is the whole of setup now, so a missing
+ * git root means nothing was installed.
  */
 export function buildNoGitRepoMessage(fileName) {
     return [
@@ -106,8 +111,6 @@ export function buildNoGitRepoMessage(fileName) {
         "   To finish setup, either:",
         "     • run `git init` here, then re-run `dotreq ai-setup`, or",
         "     • `cd` into an existing project directory and run `dotreq ai-setup` there.",
-        "",
-        "   Note: the MCP server itself was configured successfully — only the context file step was skipped.",
     ].join("\n");
 }
 //# sourceMappingURL=context-file.js.map

package/dist/utils/env.js

@@ -23,7 +23,7 @@ export function loadEnvFile(cwd = process.cwd(), force = false) {
             const match = line.match(/^([^=]+)=(.*)$/);
             if (match) {
                 const key = match[1].trim();
-                const value = match[2].trim();
+                const value = stripSurroundingQuotes(match[2].trim());
                 // Set if force=true, or if not already in process.env
                 if (force || !process.env[key]) {
                     process.env[key] = value;
@@ -36,4 +36,20 @@ export function loadEnvFile(cwd = process.cwd(), force = false) {
         // The commands will error appropriately if env vars are missing
     }
 }
+/**
+ * Strip a single matching pair of surrounding single or double quotes from a
+ * value, matching dotenv behavior. Credentials written in standard
+ * dotenv/Next.js style (KEY="value") should not carry the quote characters
+ * into process.env. Mismatched or interior quotes are left untouched.
+ */
+function stripSurroundingQuotes(value) {
+    if (value.length >= 2) {
+        const first = value[0];
+        const last = value[value.length - 1];
+        if ((first === '"' || first === "'") && first === last) {
+            return value.slice(1, -1);
+        }
+    }
+    return value;
+}
 //# sourceMappingURL=env.js.map

package/dist/utils/oauth-flow.js

@@ -32,6 +32,14 @@ export async function executeOAuthFlow() {
         port: 3010,
         timeoutMs: 120000,
     });
+    // Attach a no-op rejection handler immediately. startCallbackServer can
+    // reject synchronously-adjacent to creation (e.g. listen EADDRINUSE when the
+    // callback port is busy), but the real handler isn't awaited until after the
+    // browser launch below. Without this, an early rejection has no handler and
+    // Node escalates it to a fatal unhandledRejection, bypassing wrapCommand's
+    // clean CLI error formatting. The awaited `callbackPromise` below still sees
+    // the rejection and surfaces it as a normal thrown error.
+    callbackPromise.catch(() => { });
     // Build authorization URL
     const authUrl = buildAuthorizationUrl({
         clientId: WORKOS_CLIENT_ID,

package/dist/utils/project-settings.d.ts

@@ -41,6 +41,7 @@ export interface ProjectInfo {
  * Returns undefined if either is missing.
  */
 export declare function getCredentialsFromEnv(): ProjectSettings | undefined;
+export declare function setAuthFromEnv(enabled: boolean): void;
 /**
  * Find the project root by walking up from startDir looking for .requirements/ folder
  * Returns the directory containing .requirements/, or undefined if not found
@@ -54,6 +55,10 @@ export declare function readProjectSettings(projectRoot: string): ProjectSetting
 /**
  * Write project settings to .requirements/project-settings.json
  * Creates .requirements/ directory if it doesn't exist
+ *
+ * SETTINGS-2.3/2.4: fields being written replace the stored ones, but any
+ * other existing settings (defaultURL, browserTest, ...) survive — re-linking
+ * with fresh credentials must not erase the rest of the file.
  */
 export declare function writeProjectSettings(projectRoot: string, settings: ProjectSettings): void;
 /**

package/dist/utils/project-settings.js

@@ -18,6 +18,19 @@ export function getCredentialsFromEnv() {
     }
     return undefined;
 }
+/**
+ * AUTHZ-6: explicit CI/CD credential injection. Set by the global
+ * --auth-from-env flag (cli.ts preAction hook); when enabled,
+ * getProjectCredentials reads DOTREQ_PROJECT_ID / DOTREQ_PROJECT_SECRET
+ * instead of file-based discovery. Without the flag those variables are
+ * ignored entirely — the explicit opt-in prevents credential conflicts
+ * between local and CI environments. (Previously the retired MCP server's
+ * --auth-from-env; ported to the CLI with identical semantics.)
+ */
+let authFromEnv = false;
+export function setAuthFromEnv(enabled) {
+    authFromEnv = enabled;
+}
 /**
  * Find the project root by walking up from startDir looking for .requirements/ folder
  * Returns the directory containing .requirements/, or undefined if not found
@@ -106,6 +119,10 @@ export function readProjectSettings(projectRoot) {
 /**
  * Write project settings to .requirements/project-settings.json
  * Creates .requirements/ directory if it doesn't exist
+ *
+ * SETTINGS-2.3/2.4: fields being written replace the stored ones, but any
+ * other existing settings (defaultURL, browserTest, ...) survive — re-linking
+ * with fresh credentials must not erase the rest of the file.
  */
 export function writeProjectSettings(projectRoot, settings) {
     const requirementsDir = path.join(projectRoot, REQUIREMENTS_DIR);
@@ -114,7 +131,16 @@ export function writeProjectSettings(projectRoot, settings) {
     if (!fs.existsSync(requirementsDir)) {
         fs.mkdirSync(requirementsDir, { recursive: true });
     }
-    const content = `${JSON.stringify(settings, null, 2)}\n`;
+    let existing;
+    try {
+        existing = readProjectSettings(projectRoot);
+    }
+    catch {
+        // Unreadable or invalid existing file: nothing preservable, write fresh
+        existing = undefined;
+    }
+    const merged = existing ? { ...existing, ...settings } : settings;
+    const content = `${JSON.stringify(merged, null, 2)}\n`;
     fs.writeFileSync(settingsPath, content, "utf-8");
 }
 /**
@@ -144,6 +170,15 @@ export function getProjectInfo(startDir = process.cwd()) {
  * Get project credentials, throwing helpful error if not available
  */
 export function getProjectCredentials(startDir = process.cwd()) {
+    // AUTHZ-6.0 / 6.1: with the explicit flag, env credentials replace
+    // file-based discovery entirely
+    if (authFromEnv) {
+        const envCredentials = getCredentialsFromEnv();
+        if (!envCredentials) {
+            throw new Error("--auth-from-env requires both DOTREQ_PROJECT_ID and DOTREQ_PROJECT_SECRET environment variables to be set.");
+        }
+        return envCredentials;
+    }
     const info = getProjectInfo(startDir);
     if (!info) {
         throw new Error('No dotrequirements project found. Run "dotrequirements init" to create one.');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@popoverai/dotrequirements",
-  "version": "0.26.1",
-  "description": "Requirements tracking CLI, test harness, and MCP server",
+  "version": "0.27.0",
+  "description": "Requirements tracking CLI and test harness",
   "type": "module",
   "bin": {
     "dotrequirements": "./dist/cli.js",
@@ -11,8 +11,7 @@
     ".": "./dist/cli.js",
     "./test": "./dist/harness/index.js",
     "./schema": "./dist/schema/index.js",
-    "./schema/browser": "./dist/schema/browser.js",
-    "./mcp": "./dist/mcp/index.js"
+    "./schema/browser": "./dist/schema/browser.js"
   },
   "publishConfig": {
     "access": "public"
@@ -34,7 +33,6 @@
     "test-coverage",
     "bdd",
     "tdd",
-    "mcp",
     "ai-assistant"
   ],
   "author": "Will Raymer @Popover",