specfact-cli 0.47.6__tar.gz → 0.47.11__tar.gz

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/.gitignore

@@ -118,6 +118,7 @@ docs/internal/
 .codex/skills/openspec-*/
 !.codex/skills/openspec-workflows/
 .agents/skills/
+!.agents/skills/openspec-workflows/
 skills-lock.json
 
 .vibe/skills/openspec-*/

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specfact-cli
-Version: 0.47.6
+Version: 0.47.11
 Summary: AI-bloat defense CLI for Python teams. Run deterministic code review, cleanup forecasts, and spec/contract evidence for AI-assisted and brownfield delivery.
 Project-URL: Homepage, https://github.com/nold-ai/specfact-cli
 Project-URL: Repository, https://github.com/nold-ai/specfact-cli.git

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "specfact-cli"
-version = "0.47.6"
+version = "0.47.11"
 description = "AI-bloat defense CLI for Python teams. Run deterministic code review, cleanup forecasts, and spec/contract evidence for AI-assisted and brownfield delivery."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -234,6 +234,8 @@ format = "ruff check . --fix && ruff format ."
 # Code scanning (Semgrep)
 # Semgrep 1.38+ deprecated implicit .semgrep.yml discovery; always pass --config explicitly.
 # Script must not be named `semgrep` (Hatch treats that as circular expansion with the semgrep CLI).
+semgrep-sast = "semgrep scan --config tools/semgrep/sast.yml {args}"
+semgrep-sast-gate = "python scripts/semgrep_sast_gate.py {args}"
 semgrep-full = "semgrep --config tools/semgrep {args}"
 scan = "semgrep --config tools/semgrep/async.yml {args}"
 scan-all = "semgrep --config tools/semgrep/async.yml ."

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/resources/bundled-module-registry/index.json

@@ -13,10 +13,10 @@
       "latest_version": "0.1.21"
     },
     {
-      "checksum_sha256": "79359da27cb1c734a928a453a786b626e7b06654f515f32ead0cf96fa8e70bc2",
-      "download_url": "https://github.com/nold-ai/specfact-cli/releases/download/module-registry-0.1.26.tar.gz",
+      "checksum_sha256": "2552567a090d15826d8439ffb9242e0bf002bbe92296bc894e17ca0ba6a773f8",
+      "download_url": "https://github.com/nold-ai/specfact-cli/releases/download/module-registry-0.1.32.tar.gz",
       "id": "module-registry",
-      "latest_version": "0.1.26"
+      "latest_version": "0.1.32"
     },
     {
       "id": "bundle-mapper",

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/src/__init__.py

@@ -3,4 +3,4 @@ SpecFact CLI - AI-bloat defense CLI for Python teams.
 """
 
 # Package version: keep in sync with pyproject.toml, setup.py, src/specfact_cli/__init__.py
-__version__ = "0.47.6"
+__version__ = "0.47.11"

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/src/specfact_cli/__init__.py

@@ -76,6 +76,6 @@ def _install_progressive_disclosure() -> None:
 # keeps missing-command and missing-parameter UX consistent outside the root CLI too.
 _install_progressive_disclosure()
 
-__version__ = "0.47.6"
+__version__ = "0.47.11"
 
 __all__ = ["__version__"]

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/src/specfact_cli/adapters/ado.py

@@ -1986,7 +1986,7 @@ class AdoAdapter(BridgeAdapter, BacklogAdapterMixin, BacklogAdapter):
         return cast(
             Any,
             self._request_with_retry(
-                lambda: requests.post(url, **request_kwargs),
+                lambda: requests.post(url, **request_kwargs),  # nosec B113 - request_kwargs always includes timeout.
                 retry_on_ambiguous_transport=retry_on_ambiguous_transport,
             ),
         )
@@ -2129,7 +2129,7 @@ class AdoAdapter(BridgeAdapter, BacklogAdapterMixin, BacklogAdapter):
         change_id_escaped = change_id.replace("'", "''")
         wiql = {
             "query": (
-                "Select [System.Id] From WorkItems "
+                "Select [System.Id] From WorkItems "  # nosec B608 - WIQL uses escaped literals, not SQL.
                 f"Where [System.TeamProject] = '{project_escaped}' "
                 f"And [System.Description] Contains 'OpenSpec Change Proposal: `{change_id_escaped}`'"
             )

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/src/specfact_cli/generators/persona_exporter.py

@@ -90,7 +90,7 @@ class PersonaExporter:
         self.project_templates_dir = project_templates_dir
 
         # Create Jinja2 environment with fallback support
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - exports trusted Markdown templates, not HTML.
             loader=FileSystemLoader(
                 [str(self.templates_dir)] + ([str(self.project_templates_dir)] if project_templates_dir else [])
             ),

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/src/specfact_cli/generators/plan_generator.py

@@ -33,7 +33,7 @@ class PlanGenerator:
             templates_dir = Path(__file__).parent.parent.parent.parent / "resources" / "templates"
 
         self.templates_dir = Path(templates_dir)
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - generates trusted text/YAML workflow templates, not HTML.
             loader=FileSystemLoader(self.templates_dir),
             # Must be False: trim_blocks removes the newline after {% endraw %}, merging `if:` with `run:`.
             trim_blocks=False,

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/src/specfact_cli/generators/protocol_generator.py

@@ -32,7 +32,7 @@ class ProtocolGenerator:
             templates_dir = Path(__file__).parent.parent.parent.parent / "resources" / "templates"
 
         self.templates_dir = Path(templates_dir)
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - generates trusted protocol Markdown, not HTML.
             loader=FileSystemLoader(self.templates_dir),
             trim_blocks=True,
             lstrip_blocks=True,

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/src/specfact_cli/generators/report_generator.py

@@ -43,7 +43,7 @@ class ReportGenerator:
             templates_dir = Path(__file__).parent.parent.parent.parent / "resources" / "templates"
 
         self.templates_dir = Path(templates_dir)
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - generates trusted validation reports, not HTML.
             loader=FileSystemLoader(self.templates_dir),
             trim_blocks=True,
             lstrip_blocks=True,

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/src/specfact_cli/generators/workflow_generator.py

@@ -38,7 +38,7 @@ class WorkflowGenerator:
             templates_dir = Path(__file__).parent.parent.parent.parent / "resources" / "templates"
 
         self.templates_dir = Path(templates_dir)
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - generates trusted text/YAML workflow templates, not HTML.
             loader=FileSystemLoader(self.templates_dir),
             # Must be False: trim_blocks removes the newline after {% endraw %}, merging `if:` with `run:`.
             trim_blocks=False,

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/src/specfact_cli/modules/module_registry/module-package.yaml

@@ -1,5 +1,5 @@
 name: module-registry
-version: 0.1.26
+version: 0.1.32
 commands:
   - module
 category: core
@@ -17,5 +17,5 @@ publisher:
 description: 'Manage modules: search, list, show, install, and upgrade.'
 license: Apache-2.0
 integrity:
-  checksum: sha256:52a65869fb3d2d36910308c954e0ba199cb1c73f24136ee0d4aa7254f0996a22
-  signature: Uo2eJ40HiWBqe77N8gjiDg7zGhsvJE/hN82+Jcto7yUoqbH7bidLw9DfVQ0CrJfgM9Y0XHAUS1+LMyPr1jAaBg==
+  checksum: sha256:a707de59cb2a706bad96a30415b693df0905cc67edf9238c0e9d601cc5b6af70
+  signature: GREOnCQAXmZvwN0s+2T6wwhPFTYiDchy/V7uut9uMHZjevK7ZDBxbTPZJhGjb1ndX7pkaL+/TfyNOuh/9AUDDw==

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/src/specfact_cli/modules/module_registry/src/commands.py

@@ -16,7 +16,7 @@ import typer
 import yaml
 from beartype import beartype
 from click.exceptions import Exit as ClickExit
-from icontract import require
+from icontract import ensure, require
 from packaging.version import InvalidVersion, Version
 from rich.console import Console
 from rich.table import Table
@@ -54,13 +54,21 @@ from specfact_cli.registry.module_packages import get_discovered_modules_for_sta
 from specfact_cli.registry.module_security import ensure_publisher_trusted, is_official_publisher
 from specfact_cli.registry.module_state import read_modules_state, write_modules_state
 from specfact_cli.registry.registry import CommandRegistry
-from specfact_cli.runtime import is_non_interactive
+from specfact_cli.runtime import is_non_interactive, refresh_loaded_module_consoles
 
 
 app = typer.Typer(help="Manage marketplace modules")
 console = Console()
 
 
+@app.callback()
+@beartype
+@ensure(lambda result: result is None, "module registry callback returns None")
+def module_registry_callback() -> None:
+    """Prepare invocation-local output streams for direct module command tests."""
+    refresh_loaded_module_consoles()
+
+
 def _module_upgrade_show_spinner() -> bool:
     """Rich Live/spinner breaks some tests; mirror ``utils.progress`` test-mode detection."""
     return os.environ.get("TEST_MODE") != "true" and os.environ.get("PYTEST_CURRENT_TEST") is None
@@ -386,10 +394,10 @@ def _install_one(module_id: str, params: _InstallOneParams) -> bool:
     except Exception as exc:
         console.print(f"[red]Failed installing {normalized}: {exc}[/red]")
         return False
-    console.print(f"[green]Installed[/green] {normalized} -> {installed_path}")
+    typer.echo(f"Installed {normalized} -> {installed_path}")
     publisher = _publisher_from_module_id(normalized)
     if is_official_publisher(publisher):
-        console.print(f"Verified: official ({publisher})")
+        typer.echo(f"Verified: official ({publisher})")
     return True
 
 

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/src/specfact_cli/registry/dependency_resolver.py

@@ -127,15 +127,18 @@ def _collect_constraints(modules: list[ModulePackageMetadata]) -> list[str]:
     seen: set[str] = set()
     for meta in modules:
         for d in meta.pip_dependencies or []:
-            if d.strip() and d not in seen:
-                constraints.append(d.strip())
-                seen.add(d)
+            normalized = d.strip()
+            if normalized and normalized not in seen:
+                constraints.append(normalized)
+                seen.add(normalized)
         for vd in meta.pip_dependencies_versioned or []:
-            spec = vd.version_specifier or ""
-            s = f"{vd.name}{spec}" if spec else vd.name
-            if s not in seen:
-                constraints.append(s)
-                seen.add(s)
+            name = vd.name.strip()
+            spec = (vd.version_specifier or "").strip()
+            s = f"{name}{spec}" if spec else name
+            normalized = s.strip()
+            if normalized and normalized not in seen:
+                constraints.append(normalized)
+                seen.add(normalized)
     return constraints
 
 

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/src/specfact_cli/registry/module_installer.py

@@ -825,7 +825,7 @@ def _extract_marketplace_archive(archive_path: Path, extract_root: Path) -> None
         try:
             archive.extractall(path=extract_root, members=members, filter="data")
         except TypeError:
-            archive.extractall(path=extract_root, members=members)
+            archive.extractall(path=extract_root, members=members)  # nosec B202 - members were validated above.
 
 
 def _load_first_extracted_module_manifest(extract_root: Path) -> tuple[Path, dict[str, Any]]:

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/src/specfact_cli/telemetry.py

@@ -14,6 +14,7 @@ import json
 import logging
 import os
 import sys
+import tempfile
 import time
 from collections.abc import MutableMapping
 from contextlib import contextmanager, suppress
@@ -677,6 +678,11 @@ def test_telemetry_settings_from_env_property() -> None:
     assert isinstance(settings.opt_in_source, str)
 
 
+def _crosshair_temp_log_path() -> Path:
+    """Return a unique local telemetry log path for property tests."""
+    return Path(tempfile.gettempdir()) / f"test_telemetry-{uuid4().hex}.log"
+
+
 @beartype
 @require(lambda enabled: isinstance(enabled, bool), "enabled must be a bool")
 def test_telemetry_manager_init_property(enabled: bool) -> None:
@@ -685,7 +691,7 @@ def test_telemetry_manager_init_property(enabled: bool) -> None:
         enabled=enabled,
         endpoint=None,
         headers={},
-        local_path=Path("/tmp/test_telemetry.log"),
+        local_path=_crosshair_temp_log_path(),
         debug=False,
         opt_in_source="disabled",
     )
@@ -752,7 +758,7 @@ def test_telemetry_manager_normalize_value_property(value: Any) -> None:
 @require(lambda event: isinstance(event, Mapping), "event must be a Mapping")
 def test_telemetry_manager_write_local_event_property(event: Mapping[str, Any]) -> None:
     """CrossHair property test for TelemetryManager._write_local_event."""
-    manager = TelemetryManager(TelemetrySettings(enabled=False, local_path=Path("/tmp/test_telemetry.log")))
+    manager = TelemetryManager(TelemetrySettings(enabled=False, local_path=_crosshair_temp_log_path()))
     # This test verifies the function doesn't raise exceptions
     # Actual file writing is tested in integration tests
     with suppress(OSError):  # Expected in some test environments
@@ -763,7 +769,7 @@ def test_telemetry_manager_write_local_event_property(event: Mapping[str, Any])
 @require(lambda event: isinstance(event, MutableMapping), "event must be a MutableMapping")
 def test_telemetry_manager_emit_event_property(event: MutableMapping[str, Any]) -> None:
     """CrossHair property test for TelemetryManager._emit_event."""
-    manager = TelemetryManager(TelemetrySettings(enabled=False, local_path=Path("/tmp/test_telemetry.log")))
+    manager = TelemetryManager(TelemetrySettings(enabled=False, local_path=_crosshair_temp_log_path()))
     manager._emit_event(event)
     assert manager._last_event is not None
     assert isinstance(manager._last_event, dict)
@@ -779,7 +785,7 @@ def test_telemetry_manager_track_command_property(command: str, initial_metadata
     """CrossHair property test for TelemetryManager.track_command."""
     if not command or len(command) == 0:
         return  # Skip invalid inputs
-    manager = TelemetryManager(TelemetrySettings(enabled=True, local_path=Path("/tmp/test_telemetry.log")))
+    manager = TelemetryManager(TelemetrySettings(enabled=True, local_path=_crosshair_temp_log_path()))
     try:
         with manager.track_command(command, initial_metadata) as record:
             assert callable(record)

{specfact_cli-0.47.6 → specfact_cli-0.47.11}/src/specfact_cli/utils/suggestions.py

@@ -52,7 +52,7 @@ def suggest_next_steps(repo_path: Path, context: ProjectContext | None = None) -
 
     # Analysis suggestions
     if context.has_plan and context.contract_coverage < 0.5:
-        suggestions.append("specfact analyze --bundle <name>  # Analyze contract coverage")
+        suggestions.append("specfact code analyze contracts --bundle <name>  # Analyze contract coverage")
         suggestions.append("specfact code import --repo . <name>  # Update the project bundle from code")
 
     # Specmatic integration suggestions
@@ -95,8 +95,8 @@ def suggest_fixes(error_message: str, context: ProjectContext | None = None) ->
 
     # Contract validation errors
     if "contract" in error_lower and ("violation" in error_lower or "invalid" in error_lower):
-        suggestions.append("specfact analyze --bundle <name>  # Analyze contract violations")
-        suggestions.append("specfact repro --bundle <name>  # Run validation suite")
+        suggestions.append("specfact code analyze contracts --bundle <name>  # Analyze contract violations")
+        suggestions.append("specfact code repro --repo .  # Run validation suite")
 
     # Specmatic errors
     if "specmatic" in error_lower or "openapi" in error_lower:
@@ -126,7 +126,7 @@ def suggest_improvements(context: ProjectContext) -> list[str]:
 
     # Low contract coverage
     if context.contract_coverage < 0.3:
-        suggestions.append("specfact analyze --bundle <name>  # Identify missing contracts")
+        suggestions.append("specfact code analyze contracts --bundle <name>  # Identify missing contracts")
         suggestions.append("specfact code import --repo . <name>  # Extract contracts from code")
 
     # Missing OpenAPI specs