specfact-cli 0.47.3__tar.gz → 0.47.11__tar.gz

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/.gitignore

@@ -117,6 +117,9 @@ docs/internal/
 
 .codex/skills/openspec-*/
 !.codex/skills/openspec-workflows/
+.agents/skills/
+!.agents/skills/openspec-workflows/
+skills-lock.json
 
 .vibe/skills/openspec-*/
 !.vibe/skills/openspec-workflows/

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: specfact-cli
-Version: 0.47.3
-Summary: The swiss knife CLI for agile DevOps teams. Keep backlog, specs, tests, and code in sync with validation and contract enforcement for new projects and long-lived codebases.
+Version: 0.47.11
+Summary: AI-bloat defense CLI for Python teams. Run deterministic code review, cleanup forecasts, and spec/contract evidence for AI-assisted and brownfield delivery.
 Project-URL: Homepage, https://github.com/nold-ai/specfact-cli
 Project-URL: Repository, https://github.com/nold-ai/specfact-cli.git
 Project-URL: Documentation, https://github.com/nold-ai/specfact-cli#readme
@@ -210,7 +210,7 @@ License:                                  Apache License
            See the License for the specific language governing permissions and
            limitations under the License.
 License-File: LICENSE
-Keywords: agile,backlog,beartype,ceremonies,cli,contract-driven-development,contracts,crosshair,devops,existing-code,icontract,kanban,legacy,modernization,policy-as-code,property-based-testing,safe,scrum,specfact,specs,tdd,validation
+Keywords: agile,ai-bloat,backlog,beartype,ceremonies,clean-code,cli,code-review,contract-driven-development,contracts,crosshair,devops,existing-code,icontract,kanban,legacy,modernization,policy-as-code,property-based-testing,safe,scrum,specfact,specs,tdd,technical-debt,validation
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: Apache Software License
@@ -283,8 +283,8 @@ Description-Content-Type: text/markdown
 
 # SpecFact CLI
 
-> Review AI-assisted code against your own contracts.
-> Catch drift before it reaches PR or main.
+> Defend AI-assisted Python code from bloat before it reaches PR.
+> Run deterministic review, cleanup forecasts, and spec/contract evidence locally.
 
 [![PyPI version](https://img.shields.io/pypi/v/specfact-cli.svg?color=22c55e)](https://pypi.org/project/specfact-cli/)
 [![Python versions](https://img.shields.io/pypi/pyversions/specfact-cli.svg)](https://pypi.org/project/specfact-cli/)
@@ -315,7 +315,7 @@ uvx specfact-cli code review run --path . --scope full
 **Sample output:**
 
 ```text
-SpecFact CLI - v0.46.4
+SpecFact CLI - v0.47.4
 
 Running Ruff checks...
 Running Radon complexity checks...
@@ -347,23 +347,30 @@ specfact code review run --path . --scope full
 
 The sample output comes from a pinned capture against `nold-ai/specfact-demo-repo`. Reproduce it with `docs/_support/readme-first-contact/capture-readme-output.sh`; capture metadata lives alongside the raw logs in `docs/_support/readme-first-contact/sample-output/`.
 
-The Code Review bundle also reports `ai_bloat` advisories for code shapes that AI-assisted coding often amplifies, such as redundant wrappers, passthrough lambdas, identity `try`/`except` blocks, and avoidable intermediate lists. These findings are advisory, score-neutral, and not AI-authorship detection. Use the generated `.specfact/code-review.json` report with the Project bundle's `/specfact.08-simplify` IDE prompt to review each cleanup before accepting it. See the [AI bloat quickstart](https://modules.specfact.io/quickstart-ai-bloat/) on the modules docs site.
+## AI-bloat defense loop
+
+SpecFact is the local AI-bloat defense CLI for Python-first teams using AI IDEs. The Code Review bundle reports `ai_bloat` advisories for code shapes that AI-assisted coding often amplifies: redundant wrappers, passthrough lambdas, identity `try`/`except` blocks, avoidable intermediate lists, and long low-branch functions.
+
+For cleanup work, run a JSON review, inspect the cleanup forecast and AI-bloat index, hand remediation packets to your AI IDE, accept only safe changes, then re-run review for proof. The JSON report is the portable handoff artifact for Claude, Codex, Cursor, Copilot, or a headless agent.
+
+These findings are bloat-shape detection and cleanup guidance, not AI-authorship detection. Exact simplify flags and report fields live in the [AI bloat quickstart](https://modules.specfact.io/quickstart-ai-bloat/) and [Code Review run guide](https://modules.specfact.io/bundles/code-review/run/) on the modules docs site.
 
 ## What SpecFact does
 
-- **Reviews AI-assisted changes deterministically** — compare code against contracts, clean-code rules, and policy gates
+- **Defends against AI bloat deterministically** — forecast cleanup impact and route remediation packets to your AI IDE
+- **Reviews AI-assisted changes against evidence** — compare code against contracts, clean-code rules, and policy gates
 - **Extracts structure from existing code** — reverse-engineer brownfield repos before you change them
 - **Blocks drift before merge** — use the same checks locally, in pre-commit, and in CI
-- **Links backlog intent to code reality** — connect backlog, specs, validation, and implementation
+- **Consumes upstream planning inputs** — treat Spec Kit, OpenSpec, backlog, specs, tests, and contracts as validation evidence
 - **Stays local-first** — no cloud account, no vendor lock-in, no built-in model dependency
 
 ## What is SpecFact?
 
-SpecFact is a local CLI for catching backlog/spec/code drift before it becomes expensive. It gives solo developers, legacy maintainers, and teams a validation layer around AI-assisted delivery, brownfield reverse engineering, and contract-first reviews.
+SpecFact is a local CLI for AI-bloat defense, deterministic code review, and backlog/spec/code drift control. It gives solo developers, legacy maintainers, and teams a validation layer around AI-assisted delivery, brownfield reverse engineering, and contract-first reviews.
 
 It exists because delivery drifts in predictable ways:
 
-- AI-assisted code lands faster than validation catches up
+- AI-assisted code lands faster than cleanup and validation catch up
 - brownfield systems rarely have trustworthy up-to-date specs
 - backlog intent gets reinterpreted before it reaches code
 - teams need the same review rules across IDEs, CI, and pull requests
@@ -384,7 +391,7 @@ For a **single-hook** setup in downstream repos, keep using the stable id and sc
 
 ```yaml
 - repo: https://github.com/nold-ai/specfact-cli
-  rev: v0.46.4
+  rev: v0.47.4
   hooks:
     - id: specfact-smart-checks
 ```
@@ -412,17 +419,18 @@ SpecFact uses the same discipline it asks you to trust:
 
 ## For teams and organizations
 
-SpecFact still scales beyond the solo-developer entry path:
+SpecFact still scales beyond the solo-developer entry path, but validation stays
+the center:
 
-- **Backlog + ceremony workflows** for GitHub, Azure DevOps, Jira, and Linear
+- **Upstream context adapters** for GitHub, Azure DevOps, Jira, Linear, OpenSpec, and Spec Kit inputs
 - **DoR/DoD and policy enforcement** for teams that need repeatable gates
 - **Evidence-backed PR review** with the same checks used locally
 - **CI/CD adoption path** that keeps validation deterministic instead of model-driven
 
-Start with:
+Optional module-deep paths include:
 
-- `specfact backlog ceremony standup ...`
-- `specfact backlog ceremony refinement ...`
+- `specfact project import ...`
+- `specfact spec validate ...`
 - `specfact backlog verify-readiness --bundle <bundle-name>`
 - `specfact govern ...`
 

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/README.md

@@ -1,7 +1,7 @@
 # SpecFact CLI
 
-> Review AI-assisted code against your own contracts.
-> Catch drift before it reaches PR or main.
+> Defend AI-assisted Python code from bloat before it reaches PR.
+> Run deterministic review, cleanup forecasts, and spec/contract evidence locally.
 
 [![PyPI version](https://img.shields.io/pypi/v/specfact-cli.svg?color=22c55e)](https://pypi.org/project/specfact-cli/)
 [![Python versions](https://img.shields.io/pypi/pyversions/specfact-cli.svg)](https://pypi.org/project/specfact-cli/)
@@ -32,7 +32,7 @@ uvx specfact-cli code review run --path . --scope full
 **Sample output:**
 
 ```text
-SpecFact CLI - v0.46.4
+SpecFact CLI - v0.47.4
 
 Running Ruff checks...
 Running Radon complexity checks...
@@ -64,23 +64,30 @@ specfact code review run --path . --scope full
 
 The sample output comes from a pinned capture against `nold-ai/specfact-demo-repo`. Reproduce it with `docs/_support/readme-first-contact/capture-readme-output.sh`; capture metadata lives alongside the raw logs in `docs/_support/readme-first-contact/sample-output/`.
 
-The Code Review bundle also reports `ai_bloat` advisories for code shapes that AI-assisted coding often amplifies, such as redundant wrappers, passthrough lambdas, identity `try`/`except` blocks, and avoidable intermediate lists. These findings are advisory, score-neutral, and not AI-authorship detection. Use the generated `.specfact/code-review.json` report with the Project bundle's `/specfact.08-simplify` IDE prompt to review each cleanup before accepting it. See the [AI bloat quickstart](https://modules.specfact.io/quickstart-ai-bloat/) on the modules docs site.
+## AI-bloat defense loop
+
+SpecFact is the local AI-bloat defense CLI for Python-first teams using AI IDEs. The Code Review bundle reports `ai_bloat` advisories for code shapes that AI-assisted coding often amplifies: redundant wrappers, passthrough lambdas, identity `try`/`except` blocks, avoidable intermediate lists, and long low-branch functions.
+
+For cleanup work, run a JSON review, inspect the cleanup forecast and AI-bloat index, hand remediation packets to your AI IDE, accept only safe changes, then re-run review for proof. The JSON report is the portable handoff artifact for Claude, Codex, Cursor, Copilot, or a headless agent.
+
+These findings are bloat-shape detection and cleanup guidance, not AI-authorship detection. Exact simplify flags and report fields live in the [AI bloat quickstart](https://modules.specfact.io/quickstart-ai-bloat/) and [Code Review run guide](https://modules.specfact.io/bundles/code-review/run/) on the modules docs site.
 
 ## What SpecFact does
 
-- **Reviews AI-assisted changes deterministically** — compare code against contracts, clean-code rules, and policy gates
+- **Defends against AI bloat deterministically** — forecast cleanup impact and route remediation packets to your AI IDE
+- **Reviews AI-assisted changes against evidence** — compare code against contracts, clean-code rules, and policy gates
 - **Extracts structure from existing code** — reverse-engineer brownfield repos before you change them
 - **Blocks drift before merge** — use the same checks locally, in pre-commit, and in CI
-- **Links backlog intent to code reality** — connect backlog, specs, validation, and implementation
+- **Consumes upstream planning inputs** — treat Spec Kit, OpenSpec, backlog, specs, tests, and contracts as validation evidence
 - **Stays local-first** — no cloud account, no vendor lock-in, no built-in model dependency
 
 ## What is SpecFact?
 
-SpecFact is a local CLI for catching backlog/spec/code drift before it becomes expensive. It gives solo developers, legacy maintainers, and teams a validation layer around AI-assisted delivery, brownfield reverse engineering, and contract-first reviews.
+SpecFact is a local CLI for AI-bloat defense, deterministic code review, and backlog/spec/code drift control. It gives solo developers, legacy maintainers, and teams a validation layer around AI-assisted delivery, brownfield reverse engineering, and contract-first reviews.
 
 It exists because delivery drifts in predictable ways:
 
-- AI-assisted code lands faster than validation catches up
+- AI-assisted code lands faster than cleanup and validation catch up
 - brownfield systems rarely have trustworthy up-to-date specs
 - backlog intent gets reinterpreted before it reaches code
 - teams need the same review rules across IDEs, CI, and pull requests
@@ -101,7 +108,7 @@ For a **single-hook** setup in downstream repos, keep using the stable id and sc
 
 ```yaml
 - repo: https://github.com/nold-ai/specfact-cli
-  rev: v0.46.4
+  rev: v0.47.4
   hooks:
     - id: specfact-smart-checks
 ```
@@ -129,17 +136,18 @@ SpecFact uses the same discipline it asks you to trust:
 
 ## For teams and organizations
 
-SpecFact still scales beyond the solo-developer entry path:
+SpecFact still scales beyond the solo-developer entry path, but validation stays
+the center:
 
-- **Backlog + ceremony workflows** for GitHub, Azure DevOps, Jira, and Linear
+- **Upstream context adapters** for GitHub, Azure DevOps, Jira, Linear, OpenSpec, and Spec Kit inputs
 - **DoR/DoD and policy enforcement** for teams that need repeatable gates
 - **Evidence-backed PR review** with the same checks used locally
 - **CI/CD adoption path** that keeps validation deterministic instead of model-driven
 
-Start with:
+Optional module-deep paths include:
 
-- `specfact backlog ceremony standup ...`
-- `specfact backlog ceremony refinement ...`
+- `specfact project import ...`
+- `specfact spec validate ...`
 - `specfact backlog verify-readiness --bundle <bundle-name>`
 - `specfact govern ...`
 

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "hatchling.build"
 
 [project]
 name = "specfact-cli"
-version = "0.47.3"
-description = "The swiss knife CLI for agile DevOps teams. Keep backlog, specs, tests, and code in sync with validation and contract enforcement for new projects and long-lived codebases."
+version = "0.47.11"
+description = "AI-bloat defense CLI for Python teams. Run deterministic code review, cleanup forecasts, and spec/contract evidence for AI-assisted and brownfield delivery."
 readme = "README.md"
 requires-python = ">=3.11"
 license = { file = "LICENSE" }  # Apache License 2.0
@@ -14,8 +14,12 @@ authors = [
 ]
 keywords = [
     "agile",
+    "ai-bloat",
     "devops",
     "backlog",
+    "code-review",
+    "clean-code",
+    "technical-debt",
     "scrum",
     "kanban",
     "safe",
@@ -220,9 +224,9 @@ security-audit = "python scripts/security_audit_gate.py"
 # Development scripts
 test = "pytest {args}"
 test-cov = "pytest --cov=src --cov-report=term-missing {args}"
-type-check = "basedpyright --pythonpath $(python -c 'import sys; print(sys.executable)') {args}"
+type-check = "basedpyright --pythonpath \"$(python -c 'import sys; print(sys.executable)')\" {args}"
 # basedpyright --level error: suppress warning noise in pre-commit (Block 1 runs `hatch run lint`).
-lint = "ruff format . --check && basedpyright --level error --pythonpath $(python -c 'import sys; print(sys.executable)') && ruff check . && pylint src tests tools && python scripts/verify_safe_project_writes.py"
+lint = "ruff format . --check && basedpyright --level error --pythonpath \"$(python -c 'import sys; print(sys.executable)')\" && ruff check . && pylint src tests tools && python scripts/verify_safe_project_writes.py"
 lint-changed = "python scripts/run_changed_lint.py {args}"
 governance = "pylint src tests tools --reports=y --output-format=parseable"
 format = "ruff check . --fix && ruff format ."
@@ -230,6 +234,8 @@ format = "ruff check . --fix && ruff format ."
 # Code scanning (Semgrep)
 # Semgrep 1.38+ deprecated implicit .semgrep.yml discovery; always pass --config explicitly.
 # Script must not be named `semgrep` (Hatch treats that as circular expansion with the semgrep CLI).
+semgrep-sast = "semgrep scan --config tools/semgrep/sast.yml {args}"
+semgrep-sast-gate = "python scripts/semgrep_sast_gate.py {args}"
 semgrep-full = "semgrep --config tools/semgrep {args}"
 scan = "semgrep --config tools/semgrep/async.yml {args}"
 scan-all = "semgrep --config tools/semgrep/async.yml ."

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/resources/bundled-module-registry/index.json

@@ -13,10 +13,10 @@
       "latest_version": "0.1.21"
     },
     {
-      "checksum_sha256": "79359da27cb1c734a928a453a786b626e7b06654f515f32ead0cf96fa8e70bc2",
-      "download_url": "https://github.com/nold-ai/specfact-cli/releases/download/module-registry-0.1.26.tar.gz",
+      "checksum_sha256": "2552567a090d15826d8439ffb9242e0bf002bbe92296bc894e17ca0ba6a773f8",
+      "download_url": "https://github.com/nold-ai/specfact-cli/releases/download/module-registry-0.1.32.tar.gz",
       "id": "module-registry",
-      "latest_version": "0.1.26"
+      "latest_version": "0.1.32"
     },
     {
       "id": "bundle-mapper",

specfact_cli-0.47.11/src/__init__.py

@@ -0,0 +1,6 @@
+"""
+SpecFact CLI - AI-bloat defense CLI for Python teams.
+"""
+
+# Package version: keep in sync with pyproject.toml, setup.py, src/specfact_cli/__init__.py
+__version__ = "0.47.11"

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/src/specfact_cli/__init__.py

@@ -1,7 +1,8 @@
 """
-SpecFact CLI - The swiss knife CLI for agile DevOps teams.
+SpecFact CLI - AI-bloat defense CLI for Python teams.
 
 This package provides command-line tools for:
+- Defending AI-assisted code against cleanup bloat
 - Turning code into clear specs and plans
 - Keeping backlog, specs, tests, and code in sync
 - Enforcing validation and contract checks before production
@@ -75,6 +76,6 @@ def _install_progressive_disclosure() -> None:
 # keeps missing-command and missing-parameter UX consistent outside the root CLI too.
 _install_progressive_disclosure()
 
-__version__ = "0.47.3"
+__version__ = "0.47.11"
 
 __all__ = ["__version__"]

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/src/specfact_cli/adapters/ado.py

@@ -1986,7 +1986,7 @@ class AdoAdapter(BridgeAdapter, BacklogAdapterMixin, BacklogAdapter):
         return cast(
             Any,
             self._request_with_retry(
-                lambda: requests.post(url, **request_kwargs),
+                lambda: requests.post(url, **request_kwargs),  # nosec B113 - request_kwargs always includes timeout.
                 retry_on_ambiguous_transport=retry_on_ambiguous_transport,
             ),
         )
@@ -2129,7 +2129,7 @@ class AdoAdapter(BridgeAdapter, BacklogAdapterMixin, BacklogAdapter):
         change_id_escaped = change_id.replace("'", "''")
         wiql = {
             "query": (
-                "Select [System.Id] From WorkItems "
+                "Select [System.Id] From WorkItems "  # nosec B608 - WIQL uses escaped literals, not SQL.
                 f"Where [System.TeamProject] = '{project_escaped}' "
                 f"And [System.Description] Contains 'OpenSpec Change Proposal: `{change_id_escaped}`'"
             )

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/src/specfact_cli/cli.py

@@ -87,19 +87,12 @@ KNOWN_BUNDLE_GROUP_OR_SHIM_NAMES: frozenset[str] = frozenset(
         "project",
         "spec",
         "govern",
-        "plan",
-        "validate",
         "contract",
         "sdd",
         "generate",
         "enforce",
         "patch",
-        "migrate",
-        "repro",
-        "drift",
-        "analyze",
         "policy",
-        "sync",
     }
 )
 
@@ -109,14 +102,7 @@ _INVOKED_TO_MARKETPLACE_MODULE: dict[str, str] = {
     "backlog": "nold-ai/specfact-backlog",
     "policy": "nold-ai/specfact-backlog",
     "code": "nold-ai/specfact-codebase",
-    "analyze": "nold-ai/specfact-codebase",
-    "drift": "nold-ai/specfact-codebase",
-    "validate": "nold-ai/specfact-codebase",
-    "repro": "nold-ai/specfact-codebase",
     "project": "nold-ai/specfact-project",
-    "plan": "nold-ai/specfact-project",
-    "sync": "nold-ai/specfact-project",
-    "migrate": "nold-ai/specfact-project",
     "spec": "nold-ai/specfact-spec",
     "contract": "nold-ai/specfact-spec",
     "sdd": "nold-ai/specfact-spec",
@@ -126,6 +112,18 @@ _INVOKED_TO_MARKETPLACE_MODULE: dict[str, str] = {
     "patch": "nold-ai/specfact-govern",
 }
 
+# Removed flat root aliases -> canonical grouped replacement (see docs/migration/migration-guide.md).
+# These must never route through marketplace module availability diagnostics.
+_REMOVED_FLAT_ALIAS_TO_CANONICAL: dict[str, str] = {
+    "plan": "specfact project",
+    "validate": "specfact code validate",
+    "analyze": "specfact code analyze",
+    "drift": "specfact code drift",
+    "repro": "specfact code repro",
+    "sync": "specfact project sync",
+    "migrate": "specfact project migrate",
+}
+
 
 def _print_missing_bundle_command_help(invoked: str) -> None:
     """Print install guidance when a bundle group or shim is not registered."""
@@ -168,34 +166,81 @@ def _print_missing_bundle_command_help(invoked: str) -> None:
     )
 
 
+def _print_removed_flat_alias_help(invoked: str) -> None:
+    """Print canonical grouped-command guidance for a removed flat root alias."""
+    canonical = _REMOVED_FLAT_ALIAS_TO_CANONICAL[invoked]
+    console = get_configured_console()
+    console.print(
+        f"[bold red]No such command '{invoked}'.[/bold red]\n"
+        f"The flat [bold]specfact {invoked}[/bold] command was removed. "
+        f"Use [bold]{canonical} ...[/bold] instead."
+    )
+
+
+def _print_unresolved_root_token_help(invoked: str) -> bool:
+    """Render guidance for an unresolved root token; return True when guidance was printed."""
+    if invoked in _REMOVED_FLAT_ALIAS_TO_CANONICAL:
+        _print_removed_flat_alias_help(invoked)
+        return True
+    if invoked in KNOWN_BUNDLE_GROUP_OR_SHIM_NAMES:
+        _print_missing_bundle_command_help(invoked)
+        return True
+    return False
+
+
+def _resolve_root_command_with_guidance(resolve: Callable[[Any, list[str]], Any], ctx: Any, args: list[str]) -> Any:
+    """Resolve a root command, replacing unresolved known tokens with actionable guidance."""
+    if not args:
+        return resolve(ctx, args)
+    invoked = args[0]
+    try:
+        result = resolve(ctx, args)
+    except click.UsageError:
+        if _print_unresolved_root_token_help(invoked):
+            raise SystemExit(1) from None
+        raise
+    except ValueError as exc:
+        if _print_unresolved_root_token_help(invoked):
+            raise SystemExit(1) from exc
+        raise
+    _name, cmd, remaining = result
+    if cmd is not None or not remaining:
+        return result
+    unresolved = remaining[0]
+    if _print_unresolved_root_token_help(unresolved):
+        raise SystemExit(1)
+    return result
+
+
 class _RootCLIGroup(ProgressiveDisclosureGroup):
     """Root group that shows actionable error when an unknown command is a known bundle group/shim."""
 
     @ensure(lambda result: isinstance(result, tuple) and len(result) == 3, "result must be a 3-tuple")
     def resolve_command(self, ctx: Any, args: list[str]) -> Any:
-        if not args:
-            return super().resolve_command(ctx, args)
-        invoked = args[0]
-        try:
-            result = super().resolve_command(ctx, args)
-        except click.UsageError:
-            if invoked in KNOWN_BUNDLE_GROUP_OR_SHIM_NAMES:
-                _print_missing_bundle_command_help(invoked)
-                raise SystemExit(1) from None
-            raise
-        except ValueError as exc:
-            if invoked in KNOWN_BUNDLE_GROUP_OR_SHIM_NAMES:
-                _print_missing_bundle_command_help(invoked)
-                raise SystemExit(1) from exc
-            raise
-        _name, cmd, remaining = result
-        if cmd is not None or not remaining:
-            return result
-        invoked = remaining[0]
-        if invoked not in KNOWN_BUNDLE_GROUP_OR_SHIM_NAMES:
-            return result
-        _print_missing_bundle_command_help(invoked)
-        raise SystemExit(1)
+        return _resolve_root_command_with_guidance(super().resolve_command, ctx, args)
+
+
+def _patch_missing_bundle_resolution(group: click.Group) -> click.Group:
+    """Patch a generated Typer root group to preserve missing bundle diagnostics."""
+    if getattr(group, "_specfact_missing_bundle_resolution", False):
+        return group
+
+    original_get_command = group.get_command
+    original_resolve_command = group.resolve_command
+
+    def _get_command(ctx: click.Context, cmd_name: str) -> click.Command | None:
+        command = original_get_command(ctx, cmd_name)
+        if command is None and _print_unresolved_root_token_help(cmd_name):
+            raise SystemExit(1)
+        return command
+
+    def _resolve_command(ctx: click.Context, args: list[str]) -> Any:
+        return _resolve_root_command_with_guidance(original_resolve_command, ctx, args)
+
+    group.get_command = _get_command  # type: ignore[method-assign]
+    group.resolve_command = _resolve_command  # type: ignore[method-assign]
+    group._specfact_missing_bundle_resolution = True  # type: ignore[attr-defined]
+    return group
 
 
 # Map shell names for completion support
@@ -581,8 +626,7 @@ def _load_lazy_delegate_typer(cmd_name: str) -> typer.Typer:
     try:
         return CommandRegistry.get_typer(resolved_name)
     except ValueError as exc:
-        if cmd_name in KNOWN_BUNDLE_GROUP_OR_SHIM_NAMES:
-            _print_missing_bundle_command_help(cmd_name)
+        if _print_unresolved_root_token_help(cmd_name):
             raise SystemExit(1) from None
         _raise_lazy_delegate_click_exception(exc)
         raise AssertionError("unreachable") from None
@@ -866,6 +910,8 @@ def _get_command(typer_instance: typer.Typer) -> click.Command:
         return _build_lazy_delegate_group(cmd_name, help_str)
     assert _typer_get_command_original is not None
     result = _typer_get_command_original(typer_instance)
+    if typer_instance is app and isinstance(result, click.Group):
+        result = _patch_missing_bundle_resolution(result)
     flatten_name = getattr(typer_instance, "_specfact_flatten_same_name", None)
     if isinstance(flatten_name, str) and isinstance(result, click.Group) and flatten_name in result.commands:
         _flatten_specfact_nested_subgroup(result, flatten_name)
@@ -894,6 +940,8 @@ def _get_group_from_info_wrapper(
         suggest_commands=suggest_commands,
         rich_markup_mode=rich_markup_mode,
     )
+    if typer_instance is app:
+        result = _patch_missing_bundle_resolution(result)
     flatten_name = getattr(typer_instance, "_specfact_flatten_same_name", None) if typer_instance else None
     if isinstance(flatten_name, str) and flatten_name in result.commands:
         _flatten_specfact_nested_subgroup(result, flatten_name)

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/src/specfact_cli/generators/persona_exporter.py

@@ -90,7 +90,7 @@ class PersonaExporter:
         self.project_templates_dir = project_templates_dir
 
         # Create Jinja2 environment with fallback support
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - exports trusted Markdown templates, not HTML.
             loader=FileSystemLoader(
                 [str(self.templates_dir)] + ([str(self.project_templates_dir)] if project_templates_dir else [])
             ),

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/src/specfact_cli/generators/plan_generator.py

@@ -33,7 +33,7 @@ class PlanGenerator:
             templates_dir = Path(__file__).parent.parent.parent.parent / "resources" / "templates"
 
         self.templates_dir = Path(templates_dir)
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - generates trusted text/YAML workflow templates, not HTML.
             loader=FileSystemLoader(self.templates_dir),
             # Must be False: trim_blocks removes the newline after {% endraw %}, merging `if:` with `run:`.
             trim_blocks=False,

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/src/specfact_cli/generators/protocol_generator.py

@@ -32,7 +32,7 @@ class ProtocolGenerator:
             templates_dir = Path(__file__).parent.parent.parent.parent / "resources" / "templates"
 
         self.templates_dir = Path(templates_dir)
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - generates trusted protocol Markdown, not HTML.
             loader=FileSystemLoader(self.templates_dir),
             trim_blocks=True,
             lstrip_blocks=True,

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/src/specfact_cli/generators/report_generator.py

@@ -43,7 +43,7 @@ class ReportGenerator:
             templates_dir = Path(__file__).parent.parent.parent.parent / "resources" / "templates"
 
         self.templates_dir = Path(templates_dir)
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - generates trusted validation reports, not HTML.
             loader=FileSystemLoader(self.templates_dir),
             trim_blocks=True,
             lstrip_blocks=True,

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/src/specfact_cli/generators/workflow_generator.py

@@ -38,7 +38,7 @@ class WorkflowGenerator:
             templates_dir = Path(__file__).parent.parent.parent.parent / "resources" / "templates"
 
         self.templates_dir = Path(templates_dir)
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - generates trusted text/YAML workflow templates, not HTML.
             loader=FileSystemLoader(self.templates_dir),
             # Must be False: trim_blocks removes the newline after {% endraw %}, merging `if:` with `run:`.
             trim_blocks=False,

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/src/specfact_cli/modules/module_registry/module-package.yaml

@@ -1,5 +1,5 @@
 name: module-registry
-version: 0.1.26
+version: 0.1.32
 commands:
   - module
 category: core
@@ -17,5 +17,5 @@ publisher:
 description: 'Manage modules: search, list, show, install, and upgrade.'
 license: Apache-2.0
 integrity:
-  checksum: sha256:52a65869fb3d2d36910308c954e0ba199cb1c73f24136ee0d4aa7254f0996a22
-  signature: Uo2eJ40HiWBqe77N8gjiDg7zGhsvJE/hN82+Jcto7yUoqbH7bidLw9DfVQ0CrJfgM9Y0XHAUS1+LMyPr1jAaBg==
+  checksum: sha256:a707de59cb2a706bad96a30415b693df0905cc67edf9238c0e9d601cc5b6af70
+  signature: GREOnCQAXmZvwN0s+2T6wwhPFTYiDchy/V7uut9uMHZjevK7ZDBxbTPZJhGjb1ndX7pkaL+/TfyNOuh/9AUDDw==

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/src/specfact_cli/modules/module_registry/src/commands.py

@@ -16,7 +16,7 @@ import typer
 import yaml
 from beartype import beartype
 from click.exceptions import Exit as ClickExit
-from icontract import require
+from icontract import ensure, require
 from packaging.version import InvalidVersion, Version
 from rich.console import Console
 from rich.table import Table
@@ -54,13 +54,21 @@ from specfact_cli.registry.module_packages import get_discovered_modules_for_sta
 from specfact_cli.registry.module_security import ensure_publisher_trusted, is_official_publisher
 from specfact_cli.registry.module_state import read_modules_state, write_modules_state
 from specfact_cli.registry.registry import CommandRegistry
-from specfact_cli.runtime import is_non_interactive
+from specfact_cli.runtime import is_non_interactive, refresh_loaded_module_consoles
 
 
 app = typer.Typer(help="Manage marketplace modules")
 console = Console()
 
 
+@app.callback()
+@beartype
+@ensure(lambda result: result is None, "module registry callback returns None")
+def module_registry_callback() -> None:
+    """Prepare invocation-local output streams for direct module command tests."""
+    refresh_loaded_module_consoles()
+
+
 def _module_upgrade_show_spinner() -> bool:
     """Rich Live/spinner breaks some tests; mirror ``utils.progress`` test-mode detection."""
     return os.environ.get("TEST_MODE") != "true" and os.environ.get("PYTEST_CURRENT_TEST") is None
@@ -386,10 +394,10 @@ def _install_one(module_id: str, params: _InstallOneParams) -> bool:
     except Exception as exc:
         console.print(f"[red]Failed installing {normalized}: {exc}[/red]")
         return False
-    console.print(f"[green]Installed[/green] {normalized} -> {installed_path}")
+    typer.echo(f"Installed {normalized} -> {installed_path}")
     publisher = _publisher_from_module_id(normalized)
     if is_official_publisher(publisher):
-        console.print(f"Verified: official ({publisher})")
+        typer.echo(f"Verified: official ({publisher})")
     return True
 
 

{specfact_cli-0.47.3 → specfact_cli-0.47.11}/src/specfact_cli/registry/dependency_resolver.py

@@ -127,15 +127,18 @@ def _collect_constraints(modules: list[ModulePackageMetadata]) -> list[str]:
     seen: set[str] = set()
     for meta in modules:
         for d in meta.pip_dependencies or []:
-            if d.strip() and d not in seen:
-                constraints.append(d.strip())
-                seen.add(d)
+            normalized = d.strip()
+            if normalized and normalized not in seen:
+                constraints.append(normalized)
+                seen.add(normalized)
         for vd in meta.pip_dependencies_versioned or []:
-            spec = vd.version_specifier or ""
-            s = f"{vd.name}{spec}" if spec else vd.name
-            if s not in seen:
-                constraints.append(s)
-                seen.add(s)
+            name = vd.name.strip()
+            spec = (vd.version_specifier or "").strip()
+            s = f"{name}{spec}" if spec else name
+            normalized = s.strip()
+            if normalized and normalized not in seen:
+                constraints.append(normalized)
+                seen.add(normalized)
     return constraints