@planu/cli 4.0.0 → 4.1.1

package/CHANGELOG.md

@@ -1,3 +1,24 @@
+## [4.1.1] - 2026-05-21
+
+### Features
+- Enforce dependency freshness as a blocking pre-push gate for lockfile drift, high/critical vulnerabilities, and outdated direct dependencies.
+- Add the same pnpm dependency freshness guard to Planu-generated pre-push hooks.
+
+### Tests
+- Add coverage for the dependency freshness script and generated hook contents.
+
+
+## [4.1.0] - 2026-05-21
+
+### Features
+- Enforce English-only persisted Planu artifacts across specs, skills, agent instructions, and rules.
+- Gate host-aware init scaffolding for `AGENTS.md`, `CLAUDE.md`, Cursor, Windsurf, Cline, Gemini, Codex, and OpenCode generated AI docs.
+- Keep user-authored host file content intact while validating only Planu-owned generated blocks.
+
+### Tests
+- Add coverage for skill, rule, and agent instruction language gates across core writers and host generators.
+
+
 ## [4.0.0] - 2026-05-20
 
 **Tarball SHA-256:** `8c00d74f48ed5614197000a967b103cc17653150aadf876fcfd18d0174263017`
@@ -3792,4 +3813,4 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) · Versioning:
 - Mermaid diagram generation (architecture, sequence, state machine, ER, data flow)
 - Multi-language i18n (EN/ES/PT) for generated specs
 - Clean Architecture (hexagonal) — engine, tools, storage, types layers
-- 10,857 tests with ≥95% coverage
+- 10,857 tests with ≥95% coverage

package/dist/engine/ai-integration/agents-md/generator.js

@@ -1,6 +1,7 @@
 // engine/ai-integration/agents-md/generator.ts — Universal AGENTS.md generator (SPEC-269)
 import { writeFileSync, readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../../spec-language/english-only.js';
 const PLANU_SECTION_START = '<!-- planu-sdd:start -->';
 const PLANU_SECTION_END = '<!-- planu-sdd:end -->';
 function buildActiveSpecBlock(activeSpecId, activeSpecTitle) {
@@ -105,7 +106,9 @@ function buildSddSection(options) {
         parts.push('', approvedQueueBlock);
     }
     parts.push('', toolsBlock, '', branchBlock, '', architectureBlock, '', PLANU_SECTION_END);
-    return parts.join('\n');
+    const content = parts.join('\n');
+    assertEnglishOnlyArtifactText(content, 'agent');
+    return content;
 }
 /** Generates the full universal AGENTS.md content for a project using Planu SDD. */
 export function generateUniversalAgentsMd(options) {

package/dist/engine/ai-integration/cline/clinerules-generator.js

@@ -1,6 +1,7 @@
 // engine/ai-integration/cline/clinerules-generator.ts — .clinerules generator (SPEC-271)
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../../spec-language/english-only.js';
 const SECTION_START = '<!-- planu-sdd:start -->';
 const SECTION_END = '<!-- planu-sdd:end -->';
 function buildPlanuSection(options) {
@@ -52,12 +53,16 @@ function buildPlanuSection(options) {
     lines.push('Place in `.clinerules` at project root or in `.clinerules/` directory.');
     lines.push('');
     lines.push(SECTION_END);
-    return lines.join('\n');
+    const content = lines.join('\n');
+    assertEnglishOnlyArtifactText(content, 'agent');
+    return content;
 }
 export function generateClineRules(options) {
     const stackStr = options.stack.length > 0 ? options.stack.join(', ') : 'Not specified';
     const header = [`# Cline Rules — ${options.projectName}`, '', `Stack: ${stackStr}`, ''].join('\n');
-    return header + buildPlanuSection(options);
+    const content = header + buildPlanuSection(options);
+    assertEnglishOnlyArtifactText(content, 'agent');
+    return content;
 }
 export function writeClineRules(projectPath, options) {
     const filePath = join(projectPath, '.clinerules');

package/dist/engine/ai-integration/codex/agents-md-generator.js

@@ -1,5 +1,6 @@
 import { writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../../spec-language/english-only.js';
 const PLANU_SECTION_START = '<!-- planu:start -->';
 const PLANU_SECTION_END = '<!-- planu:end -->';
 function buildWorkflowSection() {
@@ -91,6 +92,7 @@ export function generateAgentsMd(options) {
         architectureSection,
         PLANU_SECTION_END,
     ].join('\n');
+    assertEnglishOnlyArtifactText(planuBlock, 'agent');
     return planuBlock;
 }
 /**

package/dist/engine/ai-integration/cursor/cursorrules-generator.js

@@ -1,6 +1,7 @@
 // engine/ai-integration/cursor/cursorrules-generator.ts — .cursorrules generator (SPEC-268)
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../../spec-language/english-only.js';
 const SECTION_START = '<!-- planu-sdd:start -->';
 const SECTION_END = '<!-- planu-sdd:end -->';
 function buildPlanuSection(options) {
@@ -46,12 +47,16 @@ function buildPlanuSection(options) {
         lines.push('');
     }
     lines.push(SECTION_END);
-    return lines.join('\n');
+    const content = lines.join('\n');
+    assertEnglishOnlyArtifactText(content, 'agent');
+    return content;
 }
 export function generateCursorRules(options) {
     const stackStr = options.stack.length > 0 ? options.stack.join(', ') : 'Not specified';
     const header = [`# Cursor Rules — ${options.projectName}`, '', `Stack: ${stackStr}`, ''].join('\n');
-    return header + buildPlanuSection(options);
+    const content = header + buildPlanuSection(options);
+    assertEnglishOnlyArtifactText(content, 'agent');
+    return content;
 }
 export function writeCursorRules(projectPath, options) {
     const filePath = join(projectPath, '.cursorrules');

package/dist/engine/ai-integration/windsurf/windsurfrules-generator.js

@@ -1,6 +1,7 @@
 // engine/ai-integration/windsurf/windsurfrules-generator.ts — .windsurfrules generator (SPEC-268)
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../../spec-language/english-only.js';
 const SECTION_START = '<!-- planu-sdd:start -->';
 const SECTION_END = '<!-- planu-sdd:end -->';
 function buildPlanuSection(options) {
@@ -46,12 +47,16 @@ function buildPlanuSection(options) {
         lines.push('');
     }
     lines.push(SECTION_END);
-    return lines.join('\n');
+    const content = lines.join('\n');
+    assertEnglishOnlyArtifactText(content, 'agent');
+    return content;
 }
 export function generateWindsurfRules(options) {
     const stackStr = options.stack.length > 0 ? options.stack.join(', ') : 'Not specified';
     const header = [`# Windsurf Rules — ${options.projectName}`, '', `Stack: ${stackStr}`, ''].join('\n');
-    return header + buildPlanuSection(options);
+    const content = header + buildPlanuSection(options);
+    assertEnglishOnlyArtifactText(content, 'agent');
+    return content;
 }
 export function writeWindsurfRules(projectPath, options) {
     const filePath = join(projectPath, '.windsurfrules');

package/dist/engine/hooks/git-hook-generator.js

@@ -66,6 +66,37 @@ if command -v planu >/dev/null 2>&1; then
   planu detect-drift --project-id "${projectId}" --mode quick 2>/dev/null || true
 fi
 
+if command -v pnpm >/dev/null 2>&1 && [ -f "package.json" ] && [ -f "pnpm-lock.yaml" ]; then
+  echo "[Planu] Checking dependency freshness..."
+  pnpm install --frozen-lockfile --ignore-scripts >/dev/null || {
+    echo "ERROR: package.json and pnpm-lock.yaml are not synchronized."
+    echo "Run: pnpm install --lockfile-only --ignore-scripts"
+    exit 1
+  }
+  pnpm audit --audit-level=high || {
+    echo "ERROR: High or critical dependency vulnerabilities found."
+    echo "Run: pnpm audit and update the affected packages before pushing."
+    exit 1
+  }
+  OUTDATED_JSON="$(mktemp)"
+  OUTDATED_ERR="$(mktemp)"
+  set +e
+  pnpm outdated --format=json >"\${OUTDATED_JSON}" 2>"\${OUTDATED_ERR}"
+  OUTDATED_STATUS=$?
+  set -e
+  if [ "\${OUTDATED_STATUS}" -gt 1 ]; then
+    echo "ERROR: Failed to query dependency freshness from the registry."
+    cat "\${OUTDATED_ERR}"
+    rm -f "\${OUTDATED_JSON}" "\${OUTDATED_ERR}"
+    exit 1
+  fi
+  node -e "const fs=require('fs');const raw=fs.readFileSync(process.argv[1],'utf8').trim();const data=raw?JSON.parse(raw):{};const count=Array.isArray(data)?data.length:Object.keys(data).length;if(count>0){console.error('ERROR: Outdated dependencies found. Run: bash scripts/check-updates.sh --apply, pnpm update, or update intentionally before pushing.');process.exit(1)}" "\${OUTDATED_JSON}" || {
+    rm -f "\${OUTDATED_JSON}" "\${OUTDATED_ERR}"
+    exit 1
+  }
+  rm -f "\${OUTDATED_JSON}" "\${OUTDATED_ERR}"
+fi
+
 echo "[Planu] Pre-push checks complete."
 `;
 }

package/dist/engine/marketplace-fetcher/anthropic-source.js

@@ -2,6 +2,7 @@
 // Wraps fetchAnthropicSkillContent from anthropic-adapter.ts and converts to FetchedSkill[].
 import { mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../spec-language/english-only.js';
 import { fetchAnthropicSkillContent } from '../skill-registry/anthropic-adapter.js';
 import { readCache, writeCache } from './cache.js';
 // ---------------------------------------------------------------------------
@@ -107,6 +108,7 @@ async function writeSkillFile(projectPath, skillName, content) {
     const skillsDir = join(projectPath, '.claude', 'skills');
     await mkdir(skillsDir, { recursive: true });
     const filePath = join(skillsDir, `${skillName}.md`);
+    assertEnglishOnlyArtifactText(`${skillName}\n\n${content}`, 'skill');
     await writeFile(filePath, content, 'utf-8');
     return filePath;
 }

package/dist/engine/opencode/config-scaffold.js

@@ -1,6 +1,7 @@
 // src/engine/opencode/config-scaffold.ts — SPEC-966: Generate OpenCode config files
 import { mkdirSync, writeFileSync, existsSync } from 'fs';
 import { join } from 'path';
+import { assertEnglishOnlyArtifactText } from '../spec-language/english-only.js';
 const PLANU_OPENCODE_RULES = `# Planu Rules for OpenCode
 
 ## SDD Workflow
@@ -73,16 +74,19 @@ export function scaffoldOpenCodeConfig(projectPath) {
     const rulesDir = join(projectPath, '.opencode', 'rules');
     mkdirSync(rulesDir, { recursive: true });
     const rulesPath = join(rulesDir, 'planu-workflow.md');
+    assertEnglishOnlyArtifactText(PLANU_OPENCODE_RULES, 'rule');
     writeFileSync(rulesPath, PLANU_OPENCODE_RULES, 'utf-8');
     files.push(rulesPath);
     // .opencode/skills/planu-sdd.md
     const skillsDir = join(projectPath, '.opencode', 'skills');
     mkdirSync(skillsDir, { recursive: true });
     const skillsPath = join(skillsDir, 'planu-sdd.md');
+    assertEnglishOnlyArtifactText(PLANU_OPENCODE_SKILLS, 'skill');
     writeFileSync(skillsPath, PLANU_OPENCODE_SKILLS, 'utf-8');
     files.push(skillsPath);
     // AGENTS.md append (or create)
     const agentsMdPath = join(projectPath, 'AGENTS.md');
+    assertEnglishOnlyArtifactText(PLANU_AGENTS_MD_BLOCK, 'agent');
     if (existsSync(agentsMdPath)) {
         writeFileSync(agentsMdPath, '\n' + PLANU_AGENTS_MD_BLOCK + '\n', { flag: 'a' });
         files.push(agentsMdPath + ' (appended)');

package/dist/engine/rules-generator/index.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { detectAiTools, getPrimaryAiTool } from '../ai-tool-detector/index.js';
+import { assertEnglishOnlyArtifactText } from '../spec-language/english-only.js';
 // Stack-specific architecture rules catalog
 export const ARCHITECTURE_RULES = {
     nextjs: {
@@ -300,6 +301,7 @@ export function writeRules(rules) {
             if (dir) {
                 mkdirSync(dir, { recursive: true });
             }
+            assertEnglishOnlyArtifactText(rule.content, 'rule');
             writeFileSync(rule.filePath, rule.content, 'utf-8');
             written.push(rule.filePath);
         }

package/dist/engine/rules-reconciler.js

@@ -2,6 +2,7 @@
 import { readFileSync, readdirSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, basename } from 'node:path';
 import { parseConventions } from './convention-scanner/convention-parser.js';
+import { assertEnglishOnlyArtifactText } from './spec-language/english-only.js';
 // ── Helpers ───────────────────────────────────────────────────────────────────
 function listRulesFiles(projectPath) {
     const rulesDir = join(projectPath, '.claude', 'rules');
@@ -122,6 +123,7 @@ function writeNewRulesFile(projectPath, category, conventions) {
     const fileName = `${category}.md`;
     const filePath = join(rulesDir, fileName);
     const content = generateRuleFileContent(category, conventions);
+    assertEnglishOnlyArtifactText(content, 'rule');
     writeFileSync(filePath, content, 'utf-8');
     return fileName;
 }

package/dist/engine/skill-bootstrap/skill-writer.js

@@ -1,6 +1,7 @@
 // engine/skill-bootstrap/skill-writer.ts — SPEC-439: Write skills to target AI tool files
 import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../spec-language/english-only.js';
 const AUTO_SECTION_HEADER = '## Auto-installed Skills (Planu)';
 function targetToRelativePath(target) {
     switch (target) {
@@ -42,6 +43,7 @@ export function formatSkillsForTarget(skills, target) {
     return parts.join('\n\n');
 }
 export async function writeSkillFile(projectPath, target, content, autoMerge) {
+    assertEnglishOnlyArtifactText(content, 'skill');
     const relativePath = targetToRelativePath(target);
     const filePath = join(projectPath, relativePath);
     await mkdir(dirname(filePath), { recursive: true });

package/dist/engine/skill-generation/multi-agent-writer.js

@@ -2,6 +2,7 @@
 // Detects which AI agents are present in a project and writes adapted skill files.
 import { access, mkdir, writeFile, readFile } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../spec-language/english-only.js';
 import { adaptSkillForAgent } from './multi-agent-adapter.js';
 // ---------------------------------------------------------------------------
 // Agent detection signals
@@ -92,6 +93,7 @@ async function writeNewFile(filePath, content) {
  * @param targets - Optional explicit list of targets (default: auto-detect)
  */
 export async function writeSkillToAllAgents(skillContent, metadata, projectPath, targets) {
+    assertEnglishOnlyArtifactText(`${metadata.name}\n\n${metadata.description}\n\n${skillContent}`, 'skill');
     const resolvedTargets = targets ?? (await detectPresentAgents(projectPath));
     const results = [];
     await Promise.all(resolvedTargets.map(async (target) => {

package/dist/engine/spec-language/english-only.d.ts

@@ -1,15 +1,16 @@
+import type { EnglishOnlyArtifactKind, EnglishOnlyValidationResult } from '../../types/spec-language.js';
 /**
- * Validate that persisted spec documentation is authored in English.
+ * Validate that a Planu-owned persisted artifact is authored in English.
  *
  * The detector is intentionally conservative: it ignores code fences, inline code,
  * file paths, markdown headings, and BDD keywords before looking for common
  * Spanish/Portuguese function words. It should block obvious non-English prose
  * without punishing short technical descriptions.
  */
-export declare function validateEnglishOnlySpecText(text: string): {
-    ok: boolean;
-    detectedLanguage: 'en' | 'es' | 'pt' | 'unknown';
-    reason?: string;
-    signals: string[];
-};
+export declare function validateEnglishOnlyArtifactText(text: string, kind?: EnglishOnlyArtifactKind): EnglishOnlyValidationResult;
+/**
+ * Backward-compatible spec-specific entrypoint used by create_spec/update_status gates.
+ */
+export declare function validateEnglishOnlySpecText(text: string): EnglishOnlyValidationResult;
+export declare function assertEnglishOnlyArtifactText(text: string, kind: EnglishOnlyArtifactKind): void;
 //# sourceMappingURL=english-only.d.ts.map

package/dist/engine/spec-language/english-only.js

@@ -79,14 +79,14 @@ const NON_ENGLISH_SIGNATURES = {
     ]),
 };
 /**
- * Validate that persisted spec documentation is authored in English.
+ * Validate that a Planu-owned persisted artifact is authored in English.
  *
  * The detector is intentionally conservative: it ignores code fences, inline code,
  * file paths, markdown headings, and BDD keywords before looking for common
  * Spanish/Portuguese function words. It should block obvious non-English prose
  * without punishing short technical descriptions.
  */
-export function validateEnglishOnlySpecText(text) {
+export function validateEnglishOnlyArtifactText(text, kind = 'spec') {
     const tokens = tokenizeProse(text);
     if (tokens.length < MIN_PROSE_TOKENS) {
         return { ok: true, detectedLanguage: 'unknown', signals: [] };
@@ -109,10 +109,34 @@ export function validateEnglishOnlySpecText(text) {
         ok: false,
         detectedLanguage: best.lang,
         signals,
-        reason: `Spec documents must be written in English. Detected ${languageName(best.lang)} prose ` +
+        reason: `${artifactLabel(kind)} must be written in English. Detected ${languageName(best.lang)} prose ` +
             `signals: ${signals.join(', ')}.`,
     };
 }
+/**
+ * Backward-compatible spec-specific entrypoint used by create_spec/update_status gates.
+ */
+export function validateEnglishOnlySpecText(text) {
+    return validateEnglishOnlyArtifactText(text, 'spec');
+}
+export function assertEnglishOnlyArtifactText(text, kind) {
+    const validation = validateEnglishOnlyArtifactText(text, kind);
+    if (!validation.ok) {
+        throw new Error(validation.reason ?? `${artifactLabel(kind)} must be written in English.`);
+    }
+}
+function artifactLabel(kind) {
+    switch (kind) {
+        case 'spec':
+            return 'Spec documents';
+        case 'skill':
+            return 'Skill artifacts';
+        case 'agent':
+            return 'Agent instructions';
+        case 'rule':
+            return 'Rule artifacts';
+    }
+}
 function tokenizeProse(text) {
     const withoutCode = text
         .replace(/```[\s\S]*?```/g, ' ')

package/dist/engine/universal-rules/host-writer.js

@@ -2,6 +2,7 @@
 // Write a UniversalRule to disk using the appropriate host strategy.
 import { readFile, mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../spec-language/english-only.js';
 // ---------------------------------------------------------------------------
 // Claude Code writer
 // ---------------------------------------------------------------------------
@@ -14,6 +15,7 @@ async function writeForClaudeCode(rule, projectPath) {
     await mkdir(rulesDir, { recursive: true });
     const filePath = join(rulesDir, `${rule.id}.md`);
     const content = rule.buildContent('claude-code');
+    assertEnglishOnlyArtifactText(`${rule.name}\n\n${rule.description}\n\n${content}`, 'rule');
     await writeFile(filePath, content, 'utf-8');
     return filePath;
 }
@@ -39,7 +41,9 @@ async function writeForCodex(rule, projectPath) {
     }
     const open = OPEN_MARKER(rule.id);
     const close = CLOSE_MARKER(rule.id);
-    const block = `${open}\n${rule.buildContent('codex')}\n${close}`;
+    const content = rule.buildContent('codex');
+    assertEnglishOnlyArtifactText(`${rule.name}\n\n${rule.description}\n\n${content}`, 'rule');
+    const block = `${open}\n${content}\n${close}`;
     // Replace existing block or append
     const openIdx = existing.indexOf(open);
     const closeIdx = existing.indexOf(close);
@@ -74,7 +78,9 @@ async function writeForGemini(rule, projectPath) {
     }
     const open = OPEN_MARKER(rule.id);
     const close = CLOSE_MARKER(rule.id);
-    const block = `${open}\n${rule.buildContent('gemini')}\n${close}`;
+    const content = rule.buildContent('gemini');
+    assertEnglishOnlyArtifactText(`${rule.name}\n\n${rule.description}\n\n${content}`, 'rule');
+    const block = `${open}\n${content}\n${close}`;
     const openIdx = existing.indexOf(open);
     const closeIdx = existing.indexOf(close);
     let updated;

package/dist/engine/universal-rules/rules/planu-english-specs.js

@@ -1,31 +1,35 @@
 // engine/universal-rules/rules/planu-english-specs.ts — Universal rule: specs are written in English
 function buildBody() {
-    return `# Planu Specs Must Be Written in English
+    return `# Planu Artifacts Must Be Written in English
 
 Auto-generated by \`init_project\`. Do not edit manually.
 
 ## Rule
 
-All generated spec content is written in English, regardless of the user's conversation language:
+All generated Planu-owned artifacts are written in English, regardless of the user's conversation language:
 
 - \`spec.md\`
+- Planu skills, including \`SKILL.md\` and host-adapted skill blocks
+- Planu agent instructions, including \`AGENTS.md\`, \`CLAUDE.md\`, \`GEMINI.md\`, and host-specific sections
+- Planu rules, including \`.claude/rules/*.md\`, Codex rule blocks, and Gemini conventions
 - inline \`## Technical\`, \`## Files\`, and \`## Progress\` sections
 - acceptance criteria, implementation notes, validation notes, and reconciliation notes
 
-User-facing chat may use the user's preferred language. The spec contract itself stays in English so every agent, tool, and CI gate can parse it consistently.
+User-facing chat may use the user's preferred language. The persisted Planu contract stays in English so every agent, tool, and CI gate can parse it consistently.
 
 ## Hard Blocks
 
 - Do not create mixed-language acceptance criteria.
 - Do not translate BDD keywords.
+- Do not generate Planu-owned skills, agents, or rules in Spanish, Portuguese, or mixed language.
 - Do not create standalone \`technical.md\`, \`progress.md\`, \`HU.md\`, \`FICHA-TECNICA.md\`, or \`PROGRESS.md\`.
 - Do not approve a spec that contains unresolved placeholders such as \`to be determined\`, \`TBD\`, \`TODO\`, or equivalent filler.
 `;
 }
 export const planuEnglishSpecsRule = {
     id: 'planu-english-specs',
-    name: 'Planu English Specs',
-    description: 'Requires Planu spec artifacts to be written in English.',
+    name: 'Planu English Artifacts',
+    description: 'Requires Planu spec, skill, agent, and rule artifacts to be written in English.',
     category: 'quality',
     applicableHosts: ['all'],
     defaultEnabled: true,

package/dist/hosts/claude-code/ux/skills-writer.js

@@ -4,6 +4,7 @@
 import { readFile, writeFile, mkdir, access } from 'node:fs/promises';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { assertEnglishOnlyArtifactText } from '../../../engine/spec-language/english-only.js';
 const SKILLS_DIR = '.claude/skills';
 /** Canonical skill slugs managed by SPEC-588. */
 const SKILL_SLUGS = [
@@ -68,6 +69,7 @@ async function writeSkillFile(projectPath, slug, content) {
     if (existing === content) {
         return { path: dest, created: false };
     }
+    assertEnglishOnlyArtifactText(content, 'skill');
     await writeFile(dest, content, 'utf-8');
     return { path: dest, created: existing === null };
 }

package/dist/hosts/codex/config-scaffold.js

@@ -12,6 +12,7 @@ import { mkdir, writeFile, readFile, access } from 'node:fs/promises';
 import { join } from 'node:path';
 import { detectCodexWorkspace } from './workspace-scope.js';
 import { buildRulesForHost } from '../../engine/host-rules-templates/index.js';
+import { assertEnglishOnlyArtifactText } from '../../engine/spec-language/english-only.js';
 const CODEX_CONFIG_TOML = `# .openai/config.toml — Planu Codex workspace configuration
 # Auto-generated by Planu init_project. Safe to customize.
 
@@ -79,6 +80,9 @@ async function writeIfMissing(filePath, content) {
         // File exists — skip (idempotent)
     }
     catch {
+        if (filePath.endsWith('AGENTS.md')) {
+            assertEnglishOnlyArtifactText(content, 'agent');
+        }
         await writeFile(filePath, content, 'utf-8');
     }
 }
@@ -91,6 +95,7 @@ const PLANU_RULES_START_REGEX = /<!-- planu:rules:start[^>]* -->/;
  */
 async function injectRulesBlock(filePath, version) {
     const block = buildRulesForHost('codex', version).rules;
+    assertEnglishOnlyArtifactText(block, 'rule');
     let existing;
     try {
         existing = await readFile(filePath, 'utf-8');

package/dist/hosts/gemini/config-scaffold.js

@@ -5,6 +5,7 @@
 import { writeFile, readFile, mkdir, access } from 'node:fs/promises';
 import { join } from 'node:path';
 import { buildRulesForHost } from '../../engine/host-rules-templates/index.js';
+import { assertEnglishOnlyArtifactText } from '../../engine/spec-language/english-only.js';
 // ---------------------------------------------------------------------------
 // File content generators
 // ---------------------------------------------------------------------------
@@ -144,6 +145,8 @@ export async function scaffoldGeminiConfig(projectPath, planuVersion = '1.96.0')
             // Ensure parent directory exists
             const parentDir = join(projectPath, relPath.split('/').slice(0, -1).join('/'));
             await mkdir(parentDir, { recursive: true });
+            const artifactKind = relPath.includes('/skills/') ? 'skill' : 'agent';
+            assertEnglishOnlyArtifactText(content, artifactKind);
             await writeFile(fullPath, content, 'utf-8');
             filesCreated.push(relPath);
         }
@@ -166,6 +169,7 @@ const PLANU_RULES_START_REGEX = /<!-- planu:rules:start[^>]* -->/;
  */
 async function injectRulesBlock(filePath, version) {
     const block = buildRulesForHost('gemini', version).rules;
+    assertEnglishOnlyArtifactText(block, 'rule');
     let existing;
     try {
         existing = await readFile(filePath, 'utf-8');

package/dist/tools/create-skill.js

@@ -3,6 +3,7 @@
 import { readFile, mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { detectHost } from '../engine/host-detection/detect-host.js';
+import { validateEnglishOnlyArtifactText } from '../engine/spec-language/english-only.js';
 import { hashContent } from '../engine/universal-rules/user-edit-detector.js';
 import { hashProjectPath } from '../storage/base-store.js';
 import { appendAutopilotLogEntry } from '../storage/autopilot-log-store.js';
@@ -96,6 +97,26 @@ export async function handleCreateSkill(input) {
     const { projectPath, name, content, overwriteExisting } = input;
     const description = input.description ?? '';
     const host = resolveHost(input);
+    const languageValidation = validateEnglishOnlyArtifactText(`${name}\n\n${description}\n\n${content}`, 'skill');
+    if (!languageValidation.ok) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `English-only skill gate blocked create_skill.\n\n` +
+                        `${languageValidation.reason ?? 'Non-English prose detected.'}\n\n` +
+                        'Rewrite the skill name, description, and content in English before creating it.',
+                },
+            ],
+            isError: true,
+            structuredContent: {
+                error: 'SKILL_LANGUAGE_GATE_BLOCKED',
+                detectedLanguage: languageValidation.detectedLanguage,
+                signals: languageValidation.signals,
+                fixHint: 'Rewrite skill artifacts in English.',
+            },
+        };
+    }
     let result;
     try {
         switch (host) {

package/dist/tools/git/hook-ops.js

@@ -165,6 +165,36 @@ function buildPrePushScript(protectedBranches, stalenessThreshold, baseBranch) {
         '  fi',
         'fi',
         '',
+        '# Dependency freshness gate for pnpm projects',
+        'if command -v pnpm >/dev/null 2>&1 && [ -f "package.json" ] && [ -f "pnpm-lock.yaml" ]; then',
+        '  echo "[Planu] Checking dependency freshness..."',
+        '  pnpm install --frozen-lockfile --ignore-scripts >/dev/null || {',
+        '    echo "ERROR: package.json and pnpm-lock.yaml are not synchronized."',
+        '    echo "Run: pnpm install --lockfile-only --ignore-scripts"',
+        '    exit 1',
+        '  }',
+        '  pnpm audit --audit-level=high || {',
+        '    echo "ERROR: High or critical dependency vulnerabilities found."',
+        '    echo "Run: pnpm audit and update the affected packages before pushing."',
+        '    exit 1',
+        '  }',
+        '  OUTDATED_JSON=$(mktemp)',
+        '  OUTDATED_ERR=$(mktemp)',
+        '  pnpm outdated --format=json >"$OUTDATED_JSON" 2>"$OUTDATED_ERR"',
+        '  OUTDATED_STATUS=$?',
+        '  if [ "$OUTDATED_STATUS" -gt 1 ]; then',
+        '    echo "ERROR: Failed to query dependency freshness from the registry."',
+        '    cat "$OUTDATED_ERR"',
+        '    rm -f "$OUTDATED_JSON" "$OUTDATED_ERR"',
+        '    exit 1',
+        '  fi',
+        "  node -e \"const fs=require('fs');const raw=fs.readFileSync(process.argv[1],'utf8').trim();const data=raw?JSON.parse(raw):{};const count=Array.isArray(data)?data.length:Object.keys(data).length;if(count>0){console.error('ERROR: Outdated dependencies found. Run: bash scripts/check-updates.sh --apply, pnpm update, or update intentionally before pushing.');process.exit(1)}\" \"$OUTDATED_JSON\" || {",
+        '    rm -f "$OUTDATED_JSON" "$OUTDATED_ERR"',
+        '    exit 1',
+        '  }',
+        '  rm -f "$OUTDATED_JSON" "$OUTDATED_ERR"',
+        'fi',
+        '',
         'exit 0',
     ].join('\n');
 }

package/dist/tools/init-project/agents-md-writer.js

@@ -3,6 +3,7 @@
 // SPEC-972: Added host-aware tool filtering for Codex and other MCP hosts.
 import { writeFile, mkdir, access } from 'node:fs/promises';
 import { join } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../../engine/spec-language/english-only.js';
 import { CORE_AGENTS_MD_TOOLS, loadHostRegistry, filterToolsByHost, formatToolsForAgentsMd, } from '../../engine/host-tool-filter.js';
 const AGENTS_MD_PATH = 'AGENTS.md';
 const CURSORRULES_PATH = '.cursorrules';
@@ -89,6 +90,7 @@ async function writeIfMissing(path, content) {
         return false;
     }
     catch {
+        assertEnglishOnlyArtifactText(content, 'agent');
         await writeFile(path, content, 'utf-8');
         return true;
     }

package/dist/tools/init-project/conventions-writer.js

@@ -2,6 +2,7 @@
 // with project-specific conventions detected by init_project
 import { writeFile, mkdir, access } from 'node:fs/promises';
 import { join } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../../engine/spec-language/english-only.js';
 const CONVENTIONS_MD_PATH = '.claude/rules/conventions.md';
 function buildConventionsContent(knowledge) {
     const stackItems = knowledge.stack;
@@ -44,6 +45,7 @@ export async function generateConventionsMdIfMissing(projectPath, knowledge) {
         const rulesDir = join(projectPath, '.claude/rules');
         await mkdir(rulesDir, { recursive: true });
         const content = buildConventionsContent(knowledge);
+        assertEnglishOnlyArtifactText(content, 'rule');
         await writeFile(conventionsPath, content, 'utf-8');
         return true;
     }

package/dist/tools/init-project/find-skills-writer.js

@@ -2,6 +2,7 @@
 // Single hardcoded entry point for skill discovery in generated config files
 import { writeFile, mkdir, access } from 'node:fs/promises';
 import { join } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../../engine/spec-language/english-only.js';
 const FIND_SKILLS_PATH = '.claude/skills/find-skills.md';
 const FIND_SKILLS_CONTENT = `# /find-skills — Discover Available Workflows
 
@@ -42,6 +43,7 @@ export async function generateFindSkillsIfMissing(projectPath) {
     catch {
         const skillsDir = join(projectPath, '.claude', 'skills');
         await mkdir(skillsDir, { recursive: true });
+        assertEnglishOnlyArtifactText(FIND_SKILLS_CONTENT, 'skill');
         await writeFile(skillPath, FIND_SKILLS_CONTENT, 'utf-8');
         return true;
     }

package/dist/tools/init-project/helpers.js

@@ -1,4 +1,5 @@
 import { detectLegalFramework, detectThirdParties, buildDefaultPrivacyConfig, } from '../../engine/pii-detector.js';
+import { assertEnglishOnlyArtifactText } from '../../engine/spec-language/english-only.js';
 import { readFile, writeFile, access, stat } from 'node:fs/promises';
 import { join } from 'node:path';
 import { glob } from 'glob';
@@ -283,6 +284,10 @@ export async function injectSddIntoClaude(projectPath, projectSections) {
         if (updated === content) {
             continue; // nothing changed for this file
         }
+        assertEnglishOnlyArtifactText(SDD_BLOCK, 'agent');
+        if (projectSections) {
+            assertEnglishOnlyArtifactText(projectSections, 'agent');
+        }
         await writeFile(filePath, updated, 'utf-8');
         anyModified = true;
     }

package/dist/tools/init-project/per-client-files-writer.js

@@ -2,6 +2,7 @@
 import { writeFile, mkdir, access } from 'node:fs/promises';
 import { join } from 'node:path';
 import { detectAndCacheClient } from '../../engine/client-detection.js';
+import { assertEnglishOnlyArtifactText } from '../../engine/spec-language/english-only.js';
 const CURSOR_MDC_CONTENT = `---
 description: Planu SDD workflow for Cursor
 globs: ["**/*"]
@@ -70,6 +71,7 @@ async function writeIfMissing(filePath, content) {
     }
     catch {
         await mkdir(join(filePath, '..'), { recursive: true });
+        assertEnglishOnlyArtifactText(content, filePath.includes('/skills/') ? 'skill' : 'agent');
         await writeFile(filePath, content, 'utf-8');
         return true;
     }

package/dist/tools/init-project/planu-workflow-generator.js

@@ -2,6 +2,7 @@
 // SPEC-263: Autonomous CLAUDE.md that makes Planu mandatory
 import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import { dirname } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../../engine/spec-language/english-only.js';
 const PLANU_WORKFLOW_MARKER = '<!-- planu-sdd-workflow -->';
 const PLANU_WORKFLOW_CONTENT = `<!-- planu-sdd-workflow -->
 ## Planu SDD Workflow (MANDATORY)
@@ -61,6 +62,7 @@ export async function injectPlanuSection(claudeMdPath, section) {
         await mkdir(dirname(claudeMdPath), { recursive: true });
     }
     const updated = injectOrReplacePlanuBlock(existing, section.content, section.marker);
+    assertEnglishOnlyArtifactText(section.content, 'agent');
     await writeFile(claudeMdPath, updated, 'utf-8');
 }
 /**

package/dist/tools/init-project/rules-generator.js

@@ -2,6 +2,7 @@
 // SPEC-263: Autonomous CLAUDE.md that makes Planu mandatory
 import { writeFile, mkdir, access } from 'node:fs/promises';
 import { join } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../../engine/spec-language/english-only.js';
 const PLANU_WORKFLOW_RULES_PATH = '.claude/rules/planu-workflow.md';
 const PLANU_WORKFLOW_RULES_CONTENT = `# Planu SDD Workflow (MANDATORY)
 
@@ -141,7 +142,9 @@ export async function generateAgentTeamsRules(projectPath) {
     const rulesPath = join(projectPath, AGENT_TEAMS_RULES_PATH);
     const rulesDir = join(projectPath, '.claude/rules');
     await mkdir(rulesDir, { recursive: true });
-    await writeFile(rulesPath, generateAgentTeamsRulesContent(), 'utf-8');
+    const content = generateAgentTeamsRulesContent();
+    assertEnglishOnlyArtifactText(content, 'rule');
+    await writeFile(rulesPath, content, 'utf-8');
 }
 /**
  * Write .claude/rules/agent-teams.md only if it does not exist yet.
@@ -166,6 +169,7 @@ export async function generateWorkflowRules(projectPath) {
     const rulesPath = join(projectPath, PLANU_WORKFLOW_RULES_PATH);
     const rulesDir = join(projectPath, '.claude/rules');
     await mkdir(rulesDir, { recursive: true });
+    assertEnglishOnlyArtifactText(PLANU_WORKFLOW_RULES_CONTENT, 'rule');
     await writeFile(rulesPath, PLANU_WORKFLOW_RULES_CONTENT, 'utf-8');
 }
 /**
@@ -227,6 +231,7 @@ export async function generateModeRulesIfMissing(projectPath) {
     catch {
         const rulesDir = join(projectPath, '.claude/rules');
         await mkdir(rulesDir, { recursive: true });
+        assertEnglishOnlyArtifactText(PLANU_MODES_RULES_CONTENT, 'rule');
         await writeFile(rulesPath, PLANU_MODES_RULES_CONTENT, 'utf-8');
         return true;
     }
@@ -254,6 +259,7 @@ export async function generateResponseStyleRulesIfMissing(projectPath) {
     catch {
         const rulesDir = join(projectPath, '.claude/rules');
         await mkdir(rulesDir, { recursive: true });
+        assertEnglishOnlyArtifactText(RESPONSE_STYLE_RULES_CONTENT, 'rule');
         await writeFile(rulesPath, RESPONSE_STYLE_RULES_CONTENT, 'utf-8');
         return true;
     }

package/dist/tools/init-project/rules-writer.js

@@ -2,6 +2,7 @@ import { generateRules, detectAgentPlatformFromFiles } from '../../engine/skill-
 import { knowledgeStore } from '../../storage/index.js';
 import { writeFile, access, mkdir } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../../engine/spec-language/english-only.js';
 /**
  * Detect agent platform, generate rules, and write them to disk.
  * Only writes files that don't exist yet — never overwrites user custom rules.
@@ -22,6 +23,7 @@ export async function runRulesWriter(projectPath, projectId, knowledge, recommen
     }
     catch {
         await mkdir(dirname(rulesFilePath), { recursive: true });
+        assertEnglishOnlyArtifactText(generatedRules.rulesFile.content, 'rule');
         await writeFile(rulesFilePath, generatedRules.rulesFile.content, 'utf-8');
         rulesWritten = true;
     }
@@ -34,6 +36,7 @@ export async function runRulesWriter(projectPath, projectId, knowledge, recommen
         }
         catch {
             await mkdir(dirname(filePath), { recursive: true });
+            assertEnglishOnlyArtifactText(file.content, file.path.includes('skill') ? 'skill' : 'rule');
             await writeFile(filePath, file.content, 'utf-8');
             additionalFilesWritten.push(file.path);
         }

package/dist/tools/init-project/skills-multi-teammate-review-writer.js

@@ -3,6 +3,7 @@
 import { writeFile, mkdir, access, readFile } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { assertEnglishOnlyArtifactText } from '../../engine/spec-language/english-only.js';
 const SKILL_TARGET_PATH = '.claude/skills/planu-multi-teammate-review.md';
 // Resolve the template path relative to this file (works after tsc compilation too)
 function resolveTemplatePath() {
@@ -48,6 +49,7 @@ export async function generateMultiTeammateReviewSkillIfMissing(projectPath) {
         const skillsDir = join(projectPath, '.claude/skills');
         await mkdir(skillsDir, { recursive: true });
         const content = await readTemplate();
+        assertEnglishOnlyArtifactText(content, 'skill');
         await writeFile(skillPath, content, 'utf-8');
         return true;
     }

package/dist/tools/init-project/skills-writer.js

@@ -2,6 +2,7 @@
 // SPEC-519: Generate compact skill file for dense SDD mode
 import { writeFile, mkdir, access } from 'node:fs/promises';
 import { join } from 'node:path';
+import { assertEnglishOnlyArtifactText } from '../../engine/spec-language/english-only.js';
 const COMPACT_SKILL_PATH = '.claude/skills/compact.md';
 const COMPACT_SKILL_CONTENT = `# /compact — Dense SDD Mode
 
@@ -43,6 +44,7 @@ export async function generateCompactSkillIfMissing(projectPath) {
     catch {
         const skillsDir = join(projectPath, '.claude/skills');
         await mkdir(skillsDir, { recursive: true });
+        assertEnglishOnlyArtifactText(COMPACT_SKILL_CONTENT, 'skill');
         await writeFile(skillPath, COMPACT_SKILL_CONTENT, 'utf-8');
         return true;
     }

package/dist/types/spec-language.d.ts

@@ -0,0 +1,8 @@
+export type EnglishOnlyArtifactKind = 'spec' | 'skill' | 'agent' | 'rule';
+export interface EnglishOnlyValidationResult {
+    ok: boolean;
+    detectedLanguage: 'en' | 'es' | 'pt' | 'unknown';
+    reason?: string;
+    signals: string[];
+}
+//# sourceMappingURL=spec-language.d.ts.map

package/dist/types/spec-language.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=spec-language.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "4.0.0",
+  "version": "4.1.1",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -32,12 +32,12 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "3.9.14",
-    "@planu/core-darwin-x64": "3.9.14",
-    "@planu/core-linux-arm64-gnu": "3.9.14",
-    "@planu/core-linux-arm64-musl": "3.9.14",
-    "@planu/core-linux-x64-gnu": "3.9.14",
-    "@planu/core-linux-x64-musl": "3.9.14"
+    "@planu/core-darwin-arm64": "4.1.1",
+    "@planu/core-darwin-x64": "4.1.1",
+    "@planu/core-linux-arm64-gnu": "4.1.1",
+    "@planu/core-linux-arm64-musl": "4.1.1",
+    "@planu/core-linux-x64-gnu": "4.1.1",
+    "@planu/core-linux-x64-musl": "4.1.1"
   },
   "engines": {
     "node": ">=24.0.0"
@@ -68,6 +68,7 @@
     "test:integration": "vitest run tests/integration",
     "check": "pnpm typecheck && pnpm lint && pnpm format:check",
     "check:strict": "pnpm typecheck && pnpm lint && pnpm format:check && pnpm audit:deadcode && pnpm audit:circular && pnpm audit:types && pnpm audit:security && pnpm audit:licenses && pnpm audit:i18n",
+    "check:deps:fresh": "bash scripts/check-dependency-freshness.sh",
     "audit:deadcode": "knip",
     "audit:circular": "madge --circular --extensions ts src/",
     "audit:types": "type-coverage --at-least 98 --ignore-catch --strict --ignore-files 'tests/**'",
@@ -149,8 +150,8 @@
     "@commitlint/config-conventional": "^21.0.1",
     "@eslint/js": "^10.0.1",
     "@napi-rs/cli": "^3.6.2",
-    "@secretlint/secretlint-rule-no-homedir": "^13.0.0",
-    "@secretlint/secretlint-rule-preset-recommend": "^13.0.0",
+    "@secretlint/secretlint-rule-no-homedir": "^13.0.2",
+    "@secretlint/secretlint-rule-preset-recommend": "^13.0.2",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/git": "^10.0.1",
@@ -159,30 +160,30 @@
     "@semantic-release/release-notes-generator": "^14.1.1",
     "@stryker-mutator/core": "^9.6.1",
     "@stryker-mutator/vitest-runner": "^9.6.1",
-    "@supabase/supabase-js": "^2.105.4",
-    "@types/node": "^25.7.0",
-    "@vitejs/plugin-vue": "^6.0.6",
-    "@vitest/coverage-v8": "^4.1.6",
+    "@supabase/supabase-js": "^2.106.1",
+    "@types/node": "^25.9.1",
+    "@vitejs/plugin-vue": "^6.0.7",
+    "@vitest/coverage-v8": "^4.1.7",
     "@vue/test-utils": "^2.4.10",
-    "eslint": "^10.3.0",
+    "eslint": "^10.4.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-plugin-import": "^2.32.0",
     "happy-dom": "^20.9.0",
     "husky": "^9.1.7",
     "javascript-obfuscator": "^5.4.2",
-    "knip": "^6.13.1",
-    "lint-staged": "^17.0.4",
+    "knip": "^6.14.1",
+    "lint-staged": "^17.0.5",
     "madge": "^8.0.0",
     "prettier": "^3.8.3",
-    "secretlint": "^13.0.0",
+    "secretlint": "^13.0.2",
     "semantic-release": "^25.0.3",
     "tsc-alias": "^1.8.17",
     "type-coverage": "^2.29.7",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.59.3",
-    "vite": "^8.0.12",
-    "vitest": "^4.1.6",
+    "typescript-eslint": "^8.59.4",
+    "vite": "^8.0.14",
+    "vitest": "^4.1.7",
     "vue": "^3.5.34"
   }
 }