fix(bundler): report a newline-containing version constraint instead of crashing

[jawwad-ali]

Problem

_normalize_constraint matches each comma-separated clause and uses the result without checking it:

match = _SPECIFIER_CLAUSE.match(raw)
operator, version = match.groups()

_SPECIFIER_CLAUSE is anchored with ^/$, and . does not cross newlines — so a clause containing an embedded newline does not match at all, and match.groups() raises a raw AttributeError. That escapes parse_constraint's contract, which is to surface bad input as a BundlerError:

except InvalidSpecifier as exc:
    raise BundlerError(f"Invalid version constraint '{value}': {exc}") from exc

Reproduction on current main (c173bf1)

A YAML block literal — an ordinary way to write a multi-clause constraint if you don't know the comma form — reaches it directly:

requires:
  speckit_version: |
    >=1.0.0
    <2.0.0

loads as '>=1.0.0\n<2.0.0\n', and:

manifest value: '>=1.0.0\n<2.0.0\n'
  parse_constraint  -> AttributeError: 'NoneType' object has no attribute 'groups'   <-- raw crash
  satisfies         -> AttributeError: 'NoneType' object has no attribute 'groups'   <-- raw crash

Worth noting why this survived: leading and trailing newlines are fine, because \s* absorbs them. Only an embedded one fails:

'>=1.0.0\n'   -> OK >=1.0.0
'\n>=1.0.0'   -> OK >=1.0.0
'>=1.0\n.0'   -> AttributeError

Fix

Raise InvalidSpecifier for an unmatched clause, which the existing handler in parse_constraint already converts to the BundlerError callers expect — so the fix reuses the established error path rather than introducing a second one.

After the fix:

block literal  -> BundlerError: Invalid version constraint ...
embedded nl    -> BundlerError: Invalid version constraint ...
garbage nl     -> BundlerError: Invalid version constraint ...
--- unchanged ---
'>=1.0.0' / '>=1.0.0,<2' / '~=1.2' / '>=v1.0.0' / '>=1.0.0\n' / '\n>=1.0.0'  all OK
satisfies('1.5.0', '>=1.0.0,<2.0.0') = True

Verification

• Fail-before / pass-after: 3 new-vs-baseline failures with the source reverted to upstream/main → 33 passed with the fix.
• A companion parametrization pins that every valid constraint — including the leading/trailing-newline forms that already worked — is unaffected, so the guard cannot start rejecting good input.
• Scoped regression over tests/unit: 543 passed vs a clean-main baseline of 535 passed, same 2 pre-existing failures, none new.
• uvx ruff@0.15.0 check src tests → clean

No behaviour change for any input that previously succeeded — the only inputs affected are those that previously crashed with an AttributeError, which now report the documented error instead.

---

Written with assistance from Claude Code. Bug found, reproduced, and verified by me on current main.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The focused guard fixes the crash while tests cover both regression and unchanged behavior.

Pull request overview

Prevents malformed multiline version constraints from leaking AttributeError, preserving the bundler’s error contract.

Changes:

• Raises InvalidSpecifier for unmatched clauses.
• Adds regression and compatibility tests.
• Fail-before evidence was provided but not independently rerun.

File summaries

File	Description
src/specify_cli/bundler/lib/versioning.py	Routes malformed multiline constraints through BundlerError.
tests/unit/test_bundler_versioning.py	Covers multiline failures and valid constraints.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mnriem]

Please resolve conflicts

[Copilot]

Copilot review overview

🟢 Approval recommended

The narrow guard preserves successful parsing and includes focused regression and compatibility coverage.

Review effort: Balanced
Findings: None

[jawwad-ali]

@mnriem Conflicts resolved (7952e68). The fix now lives at src/specify_cli/bundles/versioning.py, and the tests import parse_constraint from specify_cli.bundles.versioning (tests/specify_cli/bundles/test_versioning.py). Copilot re-reviewed the rebased head: approval recommended, no findings.

Verified: 3 new cases fail with the source reverted to main; all 41 pass with the fix.

Rebased as a single commit on current main; uvx ruff@0.15.0 check src tests is clean. Any remaining local failures are the pre-existing Windows symlink-privilege tests, which fail identically on unmodified main.