specfact-cli 0.47.6__tar.gz → 0.48.2__tar.gz

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/.gitignore

@@ -118,6 +118,7 @@ docs/internal/
 .codex/skills/openspec-*/
 !.codex/skills/openspec-workflows/
 .agents/skills/
+!.agents/skills/openspec-workflows/
 skills-lock.json
 
 .vibe/skills/openspec-*/

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specfact-cli
-Version: 0.47.6
+Version: 0.48.2
 Summary: AI-bloat defense CLI for Python teams. Run deterministic code review, cleanup forecasts, and spec/contract evidence for AI-assisted and brownfield delivery.
 Project-URL: Homepage, https://github.com/nold-ai/specfact-cli
 Project-URL: Repository, https://github.com/nold-ai/specfact-cli.git

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "specfact-cli"
-version = "0.47.6"
+version = "0.48.2"
 description = "AI-bloat defense CLI for Python teams. Run deterministic code review, cleanup forecasts, and spec/contract evidence for AI-assisted and brownfield delivery."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -234,6 +234,8 @@ format = "ruff check . --fix && ruff format ."
 # Code scanning (Semgrep)
 # Semgrep 1.38+ deprecated implicit .semgrep.yml discovery; always pass --config explicitly.
 # Script must not be named `semgrep` (Hatch treats that as circular expansion with the semgrep CLI).
+semgrep-sast = "semgrep scan --config tools/semgrep/sast.yml {args}"
+semgrep-sast-gate = "python scripts/semgrep_sast_gate.py {args}"
 semgrep-full = "semgrep --config tools/semgrep {args}"
 scan = "semgrep --config tools/semgrep/async.yml {args}"
 scan-all = "semgrep --config tools/semgrep/async.yml ."

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/resources/bundled-module-registry/index.json

@@ -1,10 +1,10 @@
 {
   "modules": [
     {
-      "checksum_sha256": "3a563335d7a5e16e6e9ec975d6e5c77ff550d8880474eca03713b43e97d39a4a",
-      "download_url": "https://github.com/nold-ai/specfact-cli/releases/download/init-0.1.37.tar.gz",
+      "checksum_sha256": "2ffe401e068883086f2df2beed8e9d328db9f0802deb3c69212b0594bfa1be75",
+      "download_url": "https://github.com/nold-ai/specfact-cli/releases/download/init-0.1.41.tar.gz",
       "id": "init",
-      "latest_version": "0.1.37"
+      "latest_version": "0.1.41"
     },
     {
       "checksum_sha256": "35c592374b209224af9a826c21efa66947cc16bf680b20ee0463f44bee4f9b59",
@@ -13,10 +13,10 @@
       "latest_version": "0.1.21"
     },
     {
-      "checksum_sha256": "79359da27cb1c734a928a453a786b626e7b06654f515f32ead0cf96fa8e70bc2",
-      "download_url": "https://github.com/nold-ai/specfact-cli/releases/download/module-registry-0.1.26.tar.gz",
+      "checksum_sha256": "2552567a090d15826d8439ffb9242e0bf002bbe92296bc894e17ca0ba6a773f8",
+      "download_url": "https://github.com/nold-ai/specfact-cli/releases/download/module-registry-0.1.32.tar.gz",
       "id": "module-registry",
-      "latest_version": "0.1.26"
+      "latest_version": "0.1.32"
     },
     {
       "id": "bundle-mapper",

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/__init__.py

@@ -3,4 +3,4 @@ SpecFact CLI - AI-bloat defense CLI for Python teams.
 """
 
 # Package version: keep in sync with pyproject.toml, setup.py, src/specfact_cli/__init__.py
-__version__ = "0.47.6"
+__version__ = "0.48.2"

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/specfact_cli/__init__.py

@@ -76,6 +76,6 @@ def _install_progressive_disclosure() -> None:
 # keeps missing-command and missing-parameter UX consistent outside the root CLI too.
 _install_progressive_disclosure()
 
-__version__ = "0.47.6"
+__version__ = "0.48.2"
 
 __all__ = ["__version__"]

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/specfact_cli/adapters/ado.py

@@ -1986,7 +1986,7 @@ class AdoAdapter(BridgeAdapter, BacklogAdapterMixin, BacklogAdapter):
         return cast(
             Any,
             self._request_with_retry(
-                lambda: requests.post(url, **request_kwargs),
+                lambda: requests.post(url, **request_kwargs),  # nosec B113 - request_kwargs always includes timeout.
                 retry_on_ambiguous_transport=retry_on_ambiguous_transport,
             ),
         )
@@ -2129,7 +2129,7 @@ class AdoAdapter(BridgeAdapter, BacklogAdapterMixin, BacklogAdapter):
         change_id_escaped = change_id.replace("'", "''")
         wiql = {
             "query": (
-                "Select [System.Id] From WorkItems "
+                "Select [System.Id] From WorkItems "  # nosec B608 - WIQL uses escaped literals, not SQL.
                 f"Where [System.TeamProject] = '{project_escaped}' "
                 f"And [System.Description] Contains 'OpenSpec Change Proposal: `{change_id_escaped}`'"
             )

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/specfact_cli/generators/persona_exporter.py

@@ -90,7 +90,7 @@ class PersonaExporter:
         self.project_templates_dir = project_templates_dir
 
         # Create Jinja2 environment with fallback support
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - exports trusted Markdown templates, not HTML.
             loader=FileSystemLoader(
                 [str(self.templates_dir)] + ([str(self.project_templates_dir)] if project_templates_dir else [])
             ),

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/specfact_cli/generators/plan_generator.py

@@ -33,7 +33,7 @@ class PlanGenerator:
             templates_dir = Path(__file__).parent.parent.parent.parent / "resources" / "templates"
 
         self.templates_dir = Path(templates_dir)
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - generates trusted text/YAML workflow templates, not HTML.
             loader=FileSystemLoader(self.templates_dir),
             # Must be False: trim_blocks removes the newline after {% endraw %}, merging `if:` with `run:`.
             trim_blocks=False,

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/specfact_cli/generators/protocol_generator.py

@@ -32,7 +32,7 @@ class ProtocolGenerator:
             templates_dir = Path(__file__).parent.parent.parent.parent / "resources" / "templates"
 
         self.templates_dir = Path(templates_dir)
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - generates trusted protocol Markdown, not HTML.
             loader=FileSystemLoader(self.templates_dir),
             trim_blocks=True,
             lstrip_blocks=True,

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/specfact_cli/generators/report_generator.py

@@ -43,7 +43,7 @@ class ReportGenerator:
             templates_dir = Path(__file__).parent.parent.parent.parent / "resources" / "templates"
 
         self.templates_dir = Path(templates_dir)
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - generates trusted validation reports, not HTML.
             loader=FileSystemLoader(self.templates_dir),
             trim_blocks=True,
             lstrip_blocks=True,

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/specfact_cli/generators/workflow_generator.py

@@ -38,7 +38,7 @@ class WorkflowGenerator:
             templates_dir = Path(__file__).parent.parent.parent.parent / "resources" / "templates"
 
         self.templates_dir = Path(templates_dir)
-        self.env = Environment(
+        self.env = Environment(  # nosec B701 - generates trusted text/YAML workflow templates, not HTML.
             loader=FileSystemLoader(self.templates_dir),
             # Must be False: trim_blocks removes the newline after {% endraw %}, merging `if:` with `run:`.
             trim_blocks=False,

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/specfact_cli/modules/init/module-package.yaml

@@ -1,5 +1,5 @@
 name: init
-version: 0.1.37
+version: 0.1.41
 commands:
   - init
 category: core
@@ -17,5 +17,5 @@ publisher:
 description: Initialize SpecFact workspace and bootstrap local configuration.
 license: Apache-2.0
 integrity:
-  checksum: sha256:8741e8fa3408bd38e7d65d0784a25466369955dd9f16f1981a52c0e1550afbe0
-  signature: kPAMdqpcAr92gr+DwxWibXfD0mgCLSb78EwGzoXH3fHct7xss8zt/SFvJLVZ0qkYHA8/4Nu6ls0iihRN9DXhCw==
+  checksum: sha256:7ad9c0b623f52a55b45f35adf9576bea1fd47edcd3005ed2354188a6a6ea20f5
+  signature: 7ED3ulYnu2VsJvPN/rEVLFHdVdBoiqJg1a8kR1FpWTmz9ZILrT/+NYq3CtnwGIvZscD/8CEBLBqKt1+0fCqZCQ==

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/specfact_cli/modules/init/src/commands.py

@@ -48,14 +48,7 @@ from specfact_cli.utils.ide_setup import (
 )
 
 
-VALID_PROFILES: frozenset[str] = frozenset(
-    {
-        "solo-developer",
-        "backlog-team",
-        "api-first-team",
-        "enterprise-full-stack",
-    }
-)
+VALID_PROFILES: frozenset[str] = frozenset(first_run_selection.get_valid_profile_names())
 PROFILE_BUNDLES: dict[str, list[str]] = first_run_selection.PROFILE_PRESETS
 
 install_bundles_for_init = first_run_selection.install_bundles_for_init
@@ -709,6 +702,21 @@ def init_ide(
         console.print(f"[green]Updated VS Code settings:[/green] {settings_path}")
 
 
+def _write_profile_config_or_exit(repo_path: Path, profile: str) -> None:
+    try:
+        first_run_selection.write_profile_config(repo_path, profile)
+    except ValueError as e:
+        console.print(f"[red]Error:[/red] {e}")
+        raise typer.Exit(1) from e
+
+
+def _apply_explicit_profile_or_install(repo_path: Path, profile: str | None, install: str | None) -> list[str]:
+    enabled_module_ids = _apply_profile_or_install_bundles(profile, install)
+    if profile is not None:
+        _write_profile_config_or_exit(repo_path, profile)
+    return enabled_module_ids
+
+
 @app.callback(invoke_without_command=True)
 @require(lambda repo: _is_valid_repo_path(repo), "Repo path must exist and be directory")
 @ensure(lambda result: result is None, "Command should return None")
@@ -725,7 +733,10 @@ def init(
     profile: str | None = typer.Option(
         None,
         "--profile",
-        help="First-run profile preset: solo-developer, backlog-team, api-first-team, enterprise-full-stack",
+        help=(
+            "Validation tier or legacy workflow preset: solo, startup, mid_size, enterprise, "
+            "solo-developer, backlog-team, api-first-team, enterprise-full-stack"
+        ),
     ),
     install: str | None = typer.Option(
         None,
@@ -750,7 +761,7 @@ def init(
 
         enabled_module_ids: list[str] = []
         if profile is not None or install is not None:
-            enabled_module_ids = _apply_profile_or_install_bundles(profile, install)
+            enabled_module_ids = _apply_explicit_profile_or_install(repo_path, profile, install)
         elif is_first_run(user_root=INIT_USER_MODULES_ROOT) and is_non_interactive():
             console.print(
                 "[red]Error:[/red] In CI/CD (non-interactive) mode, first-run init requires "

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/specfact_cli/modules/init/src/first_run_selection.py

@@ -3,10 +3,13 @@
 from __future__ import annotations
 
 import os
+from collections.abc import Mapping
+from copy import deepcopy
 from dataclasses import dataclass
 from pathlib import Path
-from typing import Any
+from typing import Any, cast
 
+import yaml
 from beartype import beartype
 from icontract import ensure, require
 
@@ -25,8 +28,118 @@ PROFILE_PRESETS: dict[str, list[str]] = {
         "specfact-spec",
         "specfact-govern",
     ],
+    "solo": ["specfact-codebase", "specfact-code-review"],
+    "startup": ["specfact-project", "specfact-backlog", "specfact-codebase", "specfact-code-review"],
+    "mid_size": ["specfact-project", "specfact-backlog", "specfact-codebase", "specfact-spec", "specfact-code-review"],
+    "enterprise": [
+        "specfact-project",
+        "specfact-backlog",
+        "specfact-codebase",
+        "specfact-spec",
+        "specfact-govern",
+        "specfact-code-review",
+    ],
+}
+
+VALIDATION_TIER_PROFILES: tuple[str, ...] = ("solo", "startup", "mid_size", "enterprise")
+
+LEGACY_PROFILE_TO_VALIDATION_TIER: dict[str, str] = {
+    "solo-developer": "solo",
+    "backlog-team": "startup",
+    "api-first-team": "mid_size",
+    "enterprise-full-stack": "enterprise",
+}
+
+
+def _canonical_module_ids(bundle_ids: list[str]) -> list[str]:
+    return [f"nold-ai/{bundle_id}" for bundle_id in bundle_ids]
+
+
+_PROFILE_DEFAULTS: dict[str, dict[str, Any]] = {
+    "solo": {
+        "profile": "solo",
+        "validation": {
+            "severity": "advisory",
+            "policy_mode": "advisory",
+            "evidence_persistence": "local",
+        },
+        "clean_code": {
+            "mode": "advisory",
+        },
+        "modules": {
+            "enabled": _canonical_module_ids(PROFILE_PRESETS["solo"]),
+        },
+        "requirements_schema": {
+            "required_fields": ["id", "title", "acceptance"],
+        },
+    },
+    "startup": {
+        "profile": "startup",
+        "validation": {
+            "severity": "mixed",
+            "policy_mode": "mixed",
+            "evidence_persistence": "repo",
+        },
+        "clean_code": {
+            "mode": "advisory_then_mixed",
+        },
+        "modules": {
+            "enabled": _canonical_module_ids(PROFILE_PRESETS["startup"]),
+        },
+        "requirements_schema": {
+            "required_fields": ["id", "title", "owner", "acceptance"],
+        },
+    },
+    "mid_size": {
+        "profile": "mid_size",
+        "validation": {
+            "severity": "mixed",
+            "policy_mode": "mixed",
+            "evidence_persistence": "repo",
+        },
+        "clean_code": {
+            "mode": "mixed",
+        },
+        "modules": {
+            "enabled": _canonical_module_ids(PROFILE_PRESETS["mid_size"]),
+        },
+        "requirements_schema": {
+            "required_fields": ["id", "title", "owner", "acceptance", "trace_links"],
+        },
+    },
+    "enterprise": {
+        "profile": "enterprise",
+        "validation": {
+            "severity": "hard",
+            "policy_mode": "hard",
+            "evidence_persistence": "required",
+        },
+        "clean_code": {
+            "mode": "hard",
+        },
+        "modules": {
+            "enabled": _canonical_module_ids(PROFILE_PRESETS["enterprise"]),
+        },
+        "requirements_schema": {
+            "required_fields": [
+                "id",
+                "title",
+                "owner",
+                "acceptance",
+                "trace_links",
+                "risk_classification",
+                "exception_evidence",
+            ],
+        },
+    },
 }
 
+_RESERVED_CONFIG_KEYS: frozenset[str] = frozenset({"source_annotations", "profile_warnings"})
+_PROFILE_GENERATED_CONFIG_KEYS: frozenset[str] = frozenset(
+    {"validation", "clean_code", "modules", "requirements_schema"}
+)
+_POLICY_STRENGTH: dict[str, int] = {"advisory": 1, "advisory_then_mixed": 2, "mixed": 3, "hard": 4}
+
 _INSTALL_ALL_BUNDLES: tuple[str, ...] = (
     "specfact-project",
     "specfact-backlog",
@@ -53,6 +166,8 @@ BUNDLE_ALIAS_TO_CANONICAL: dict[str, str] = {
     "backlog": "specfact-backlog",
     "codebase": "specfact-codebase",
     "code": "specfact-codebase",
+    "code-review": "specfact-code-review",
+    "code_review": "specfact-code-review",
     "spec": "specfact-spec",
     "govern": "specfact-govern",
 }
@@ -83,6 +198,15 @@ BUNDLE_DISPLAY: dict[str, str] = {
 }
 
 
+@dataclass(frozen=True)
+class ResolvedProfileConfig:
+    """Resolved profile config with source annotations for each winning value."""
+
+    values: dict[str, Any]
+    sources: dict[str, Any]
+    warnings: list[str]
+
+
 def _emit_init_bundle_progress() -> bool:
     """Return True when init should print progress (suppressed during pytest)."""
     return os.environ.get("PYTEST_CURRENT_TEST") is None
@@ -107,6 +231,160 @@ def _expand_bundle_install_order(bundle_ids: list[str]) -> list[str]:
     return to_install
 
 
+def _normalize_profile_key(profile: str) -> str:
+    key = profile.strip().lower()
+    return "mid_size" if key in {"mid-size", "mid_size"} else key
+
+
+@require(lambda profile: isinstance(profile, str) and profile.strip() != "", "profile must be non-empty string")
+@ensure(lambda result: result in VALIDATION_TIER_PROFILES, "result must be a validation tier")
+@beartype
+def resolve_validation_tier(profile: str) -> str:
+    """Map a validation tier or legacy workflow preset to a validation config tier."""
+    key = profile.strip().lower()
+    normalized = _normalize_profile_key(profile)
+    if normalized in VALIDATION_TIER_PROFILES:
+        return normalized
+    if key in LEGACY_PROFILE_TO_VALIDATION_TIER:
+        return LEGACY_PROFILE_TO_VALIDATION_TIER[key]
+    valid = ", ".join(get_valid_profile_names())
+    raise ValueError(f"Unknown profile {profile!r}. Valid profiles: {valid}")
+
+
+def _source_tree(value: Any, source: str) -> Any:
+    if isinstance(value, Mapping):
+        return {str(key): _source_tree(child, source) for key, child in value.items()}
+    return source
+
+
+def _merge_config_layer(target: dict[str, Any], sources: dict[str, Any], layer: Mapping[str, Any], source: str) -> None:
+    for raw_key, raw_value in layer.items():
+        key = str(raw_key)
+        if key in _RESERVED_CONFIG_KEYS:
+            continue
+        value = deepcopy(raw_value)
+        if isinstance(value, Mapping) and isinstance(target.get(key), dict):
+            existing_source = sources.get(key)
+            if not isinstance(existing_source, dict):
+                sources[key] = {}
+            _merge_config_layer(target[key], sources[key], value, source)
+            continue
+        target[key] = value
+        sources[key] = _source_tree(value, source)
+
+
+def _extract_policy_value(layer: Mapping[str, Any] | None, key: str) -> str | None:
+    if not layer:
+        return None
+    validation = layer.get("validation")
+    if not isinstance(validation, Mapping):
+        return None
+    validation_values: dict[str, Any] = {str(raw_key): raw_value for raw_key, raw_value in validation.items()}
+    value = validation_values.get(key)
+    return value if isinstance(value, str) else None
+
+
+def _local_policy_weakened(org_baseline: Mapping[str, Any] | None, developer_local: Mapping[str, Any] | None) -> bool:
+    for key in ("severity", "policy_mode"):
+        org_value = _extract_policy_value(org_baseline, key)
+        local_value = _extract_policy_value(developer_local, key)
+        if org_value is None or local_value is None:
+            continue
+        if _POLICY_STRENGTH.get(local_value, 0) < _POLICY_STRENGTH.get(org_value, 0):
+            return True
+    return False
+
+
+@require(lambda profile: isinstance(profile, str) and profile.strip() != "", "profile must be non-empty string")
+@ensure(lambda result: isinstance(result, ResolvedProfileConfig), "result must be a resolved profile config")
+@beartype
+def resolve_profile_config(
+    profile: str,
+    *,
+    org_baseline: Mapping[str, Any] | None = None,
+    repo_overlay: Mapping[str, Any] | None = None,
+    developer_local: Mapping[str, Any] | None = None,
+) -> ResolvedProfileConfig:
+    """Resolve profile defaults, org baseline, repo overlay, and developer-local config layers."""
+    tier = resolve_validation_tier(profile)
+    values: dict[str, Any] = {}
+    sources: dict[str, Any] = {}
+    _merge_config_layer(values, sources, _PROFILE_DEFAULTS[tier], f"profile:{tier}")
+    for layer, source in (
+        (org_baseline, "org_baseline"),
+        (repo_overlay, "repo_overlay"),
+        (developer_local, "developer_local"),
+    ):
+        if layer:
+            _merge_config_layer(values, sources, layer, source)
+
+    warnings: list[str] = []
+    if _local_policy_weakened(org_baseline, developer_local):
+        warnings.append("developer_local weakens org validation policy")
+    return ResolvedProfileConfig(values=values, sources=sources, warnings=warnings)
+
+
+def _read_yaml_mapping(path: Path) -> dict[str, Any]:
+    if not path.exists():
+        return {}
+    raw = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
+    if not isinstance(raw, dict):
+        raise ValueError(f"Config file must contain a mapping: {path}")
+    return raw
+
+
+def _source_tree_contains_profile(value: Any) -> bool:
+    if isinstance(value, str):
+        return value.startswith("profile:")
+    if isinstance(value, Mapping):
+        return any(_source_tree_contains_profile(child) for child in value.values())
+    return False
+
+
+def _repo_overlay_without_generated_profile_values(raw_overlay: Mapping[str, Any]) -> dict[str, Any]:
+    overlay = {str(key): deepcopy(value) for key, value in raw_overlay.items()}
+    overlay.pop("profile", None)
+    source_annotations = overlay.pop("source_annotations", {})
+    overlay.pop("profile_warnings", None)
+    if not isinstance(source_annotations, Mapping):
+        return overlay
+    sources_by_key = {str(key): cast(Any, value) for key, value in source_annotations.items()}
+    for key in _PROFILE_GENERATED_CONFIG_KEYS:
+        if _source_tree_contains_profile(sources_by_key.get(key)):
+            overlay.pop(key, None)
+    return overlay
+
+
+@require(lambda repo_path: isinstance(repo_path, Path), "repo_path must be Path")
+@require(lambda profile: isinstance(profile, str) and profile.strip() != "", "profile must be non-empty string")
+@ensure(lambda result: isinstance(result, ResolvedProfileConfig), "result must be a resolved profile config")
+@beartype
+def write_profile_config(repo_path: Path, profile: str) -> ResolvedProfileConfig:
+    """Write `.specfact/config.yaml` for the selected profile with source annotations."""
+    specfact_dir = repo_path / ".specfact"
+    config_path = specfact_dir / "config.yaml"
+    local_path = specfact_dir / "config.local.yaml"
+    org_path = Path.home() / ".specfact" / "config.yaml"
+
+    repo_overlay = _repo_overlay_without_generated_profile_values(_read_yaml_mapping(config_path))
+    resolved = resolve_profile_config(
+        profile,
+        org_baseline=_read_yaml_mapping(org_path),
+        repo_overlay=repo_overlay,
+        developer_local=_read_yaml_mapping(local_path),
+    )
+
+    payload = deepcopy(resolved.values)
+    payload["profile"] = resolve_validation_tier(profile)
+    payload["source_annotations"] = resolved.sources
+    if resolved.warnings:
+        payload["profile_warnings"] = resolved.warnings
+
+    specfact_dir.mkdir(parents=True, exist_ok=True)
+    config_path.write_text(yaml.safe_dump(payload, sort_keys=False, allow_unicode=False), encoding="utf-8")
+    return resolved
+
+
 @dataclass
 class _InitBundleInstallDeps:
     root: Path
@@ -235,7 +513,7 @@ def _process_one_bundle_install_row(bid: str, deps: _InitBundleInstallDeps) -> N
 @beartype
 def resolve_profile_bundles(profile: str) -> list[str]:
     """Resolve a profile name to the list of canonical bundle ids to install."""
-    key = profile.strip().lower()
+    key = _normalize_profile_key(profile)
     if key not in PROFILE_PRESETS:
         valid = ", ".join(sorted(PROFILE_PRESETS))
         raise ValueError(f"Unknown profile {profile!r}. Valid profiles: {valid}")

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/specfact_cli/modules/module_registry/module-package.yaml

@@ -1,5 +1,5 @@
 name: module-registry
-version: 0.1.26
+version: 0.1.32
 commands:
   - module
 category: core
@@ -17,5 +17,5 @@ publisher:
 description: 'Manage modules: search, list, show, install, and upgrade.'
 license: Apache-2.0
 integrity:
-  checksum: sha256:52a65869fb3d2d36910308c954e0ba199cb1c73f24136ee0d4aa7254f0996a22
-  signature: Uo2eJ40HiWBqe77N8gjiDg7zGhsvJE/hN82+Jcto7yUoqbH7bidLw9DfVQ0CrJfgM9Y0XHAUS1+LMyPr1jAaBg==
+  checksum: sha256:a707de59cb2a706bad96a30415b693df0905cc67edf9238c0e9d601cc5b6af70
+  signature: GREOnCQAXmZvwN0s+2T6wwhPFTYiDchy/V7uut9uMHZjevK7ZDBxbTPZJhGjb1ndX7pkaL+/TfyNOuh/9AUDDw==

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/specfact_cli/modules/module_registry/src/commands.py

@@ -16,7 +16,7 @@ import typer
 import yaml
 from beartype import beartype
 from click.exceptions import Exit as ClickExit
-from icontract import require
+from icontract import ensure, require
 from packaging.version import InvalidVersion, Version
 from rich.console import Console
 from rich.table import Table
@@ -54,13 +54,21 @@ from specfact_cli.registry.module_packages import get_discovered_modules_for_sta
 from specfact_cli.registry.module_security import ensure_publisher_trusted, is_official_publisher
 from specfact_cli.registry.module_state import read_modules_state, write_modules_state
 from specfact_cli.registry.registry import CommandRegistry
-from specfact_cli.runtime import is_non_interactive
+from specfact_cli.runtime import is_non_interactive, refresh_loaded_module_consoles
 
 
 app = typer.Typer(help="Manage marketplace modules")
 console = Console()
 
 
+@app.callback()
+@beartype
+@ensure(lambda result: result is None, "module registry callback returns None")
+def module_registry_callback() -> None:
+    """Prepare invocation-local output streams for direct module command tests."""
+    refresh_loaded_module_consoles()
+
+
 def _module_upgrade_show_spinner() -> bool:
     """Rich Live/spinner breaks some tests; mirror ``utils.progress`` test-mode detection."""
     return os.environ.get("TEST_MODE") != "true" and os.environ.get("PYTEST_CURRENT_TEST") is None
@@ -386,10 +394,10 @@ def _install_one(module_id: str, params: _InstallOneParams) -> bool:
     except Exception as exc:
         console.print(f"[red]Failed installing {normalized}: {exc}[/red]")
         return False
-    console.print(f"[green]Installed[/green] {normalized} -> {installed_path}")
+    typer.echo(f"Installed {normalized} -> {installed_path}")
     publisher = _publisher_from_module_id(normalized)
     if is_official_publisher(publisher):
-        console.print(f"Verified: official ({publisher})")
+        typer.echo(f"Verified: official ({publisher})")
     return True
 
 

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/specfact_cli/registry/dependency_resolver.py

@@ -127,15 +127,18 @@ def _collect_constraints(modules: list[ModulePackageMetadata]) -> list[str]:
     seen: set[str] = set()
     for meta in modules:
         for d in meta.pip_dependencies or []:
-            if d.strip() and d not in seen:
-                constraints.append(d.strip())
-                seen.add(d)
+            normalized = d.strip()
+            if normalized and normalized not in seen:
+                constraints.append(normalized)
+                seen.add(normalized)
         for vd in meta.pip_dependencies_versioned or []:
-            spec = vd.version_specifier or ""
-            s = f"{vd.name}{spec}" if spec else vd.name
-            if s not in seen:
-                constraints.append(s)
-                seen.add(s)
+            name = vd.name.strip()
+            spec = (vd.version_specifier or "").strip()
+            s = f"{name}{spec}" if spec else name
+            normalized = s.strip()
+            if normalized and normalized not in seen:
+                constraints.append(normalized)
+                seen.add(normalized)
     return constraints
 
 

{specfact_cli-0.47.6 → specfact_cli-0.48.2}/src/specfact_cli/registry/module_installer.py

@@ -825,7 +825,7 @@ def _extract_marketplace_archive(archive_path: Path, extract_root: Path) -> None
         try:
             archive.extractall(path=extract_root, members=members, filter="data")
         except TypeError:
-            archive.extractall(path=extract_root, members=members)
+            archive.extractall(path=extract_root, members=members)  # nosec B202 - members were validated above.
 
 
 def _load_first_extracted_module_manifest(extract_root: Path) -> tuple[Path, dict[str, Any]]: