@planu/cli 4.10.3 → 4.10.4

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## [4.10.4] - 2026-07-06
+
+### Bug Fixes
+- fix: resolve Supabase testimonials and Planu bug backlog
+
+### Chores
+- chore(deps): update tsc-alias
+- chore(planu): clear released pending specs
+- chore(format): apply prettier baseline
+
+
 ## [4.10.3] - 2026-07-02
 
 ### Bug Fixes

package/dist/engine/spec-format/lean-spec-generator.js

@@ -2,7 +2,6 @@
 // Output: ~30-50 lines. No generic sections, no OWASP, no STRIDE, no resilience criteria.
 import { parseBddScenarios, renderBddScenariosYaml, convertCheckboxToBdd } from './bdd-parser.js';
 import { deriveModelBudget } from './model-budget-deriver.js';
-import { renderHistoryYaml } from '../spec-versioning/render-history.js';
 import { renderGroundingFrontmatter, renderTechnicalReferenceGroundingFrontmatter, } from '../spec-grounding/contract.js';
 /** Strip redundant "SPEC-XXX — " or "SPEC-XXX: " prefix from spec titles.
  * Titles must not repeat the ID since it is already stored in the `id` field. */
@@ -60,15 +59,11 @@ export function generateLeanSpecContent(input) {
     else {
         acLines = buildCheckboxLines(description, extraCriteria, input.criteriaOverride);
     }
-    // SPEC-717: render empty version history for new specs
-    const historyYaml = renderHistoryYaml([]);
     const lines = [
         ...frontmatterBase,
         ...acLines,
         'history:',
         ...history.map((h) => `  - date: ${h.date}\n    event: ${h.event}`),
-        // SPEC-717: version history (empty for new specs)
-        historyYaml,
         '---',
         '',
         description.trim(),

package/dist/tools/design-schema-sql/migrations.js

@@ -62,11 +62,12 @@ export function generateMigrations(tables, indexes, rlsPolicies, engine) {
             });
         }
         for (const policy of rlsPolicies) {
+            const rolesClause = policy.roles?.length ? ` TO ${policy.roles.join(', ')}` : '';
             const usingClause = `USING (${policy.using})`;
             const withCheckClause = policy.withCheck ? ` WITH CHECK (${policy.withCheck})` : '';
             migrations.push({
                 order: order++,
-                sql: `CREATE POLICY ${policy.name} ON ${policy.table} FOR ${policy.operation} ${usingClause}${withCheckClause};`,
+                sql: `CREATE POLICY ${policy.name} ON ${policy.table} FOR ${policy.operation}${rolesClause} ${usingClause}${withCheckClause};`,
                 reversible: true,
                 reverseSql: `DROP POLICY IF EXISTS ${policy.name} ON ${policy.table};`,
                 dataLoss: false,

package/dist/tools/design-schema-sql/tables.js

@@ -170,33 +170,41 @@ export function generateIndexes(tables, _engine) {
 export function generateRLSPolicies(tables) {
     const policies = [];
     for (const table of tables) {
+        const ownerCol = table.columns.find((c) => c.name === 'user_id' || c.name === 'owner_id' || c.name === 'created_by');
+        const ownerPredicate = ownerCol ? `(select auth.uid()) = ${ownerCol.name}` : 'true';
         policies.push({
             name: `${table.name}_select_authenticated`,
             table: table.name,
             operation: 'SELECT',
-            using: "auth.role() = 'authenticated'",
-            justification: 'Only authenticated users can read records',
+            roles: ['authenticated'],
+            using: ownerPredicate,
+            justification: ownerCol
+                ? 'Authenticated users can only read records they own'
+                : 'Only authenticated users can read records',
         });
-        const ownerCol = table.columns.find((c) => c.name === 'user_id' || c.name === 'owner_id' || c.name === 'created_by');
         if (ownerCol) {
             policies.push({
                 name: `${table.name}_insert_owner`,
                 table: table.name,
                 operation: 'INSERT',
+                roles: ['authenticated'],
                 using: 'true',
-                withCheck: `auth.uid() = ${ownerCol.name}`,
+                withCheck: ownerPredicate,
                 justification: 'Users can only insert records they own',
             }, {
                 name: `${table.name}_update_owner`,
                 table: table.name,
                 operation: 'UPDATE',
-                using: `auth.uid() = ${ownerCol.name}`,
+                roles: ['authenticated'],
+                using: ownerPredicate,
+                withCheck: ownerPredicate,
                 justification: 'Users can only update their own records',
             }, {
                 name: `${table.name}_delete_owner`,
                 table: table.name,
                 operation: 'DELETE',
-                using: `auth.uid() = ${ownerCol.name}`,
+                roles: ['authenticated'],
+                using: ownerPredicate,
                 justification: 'Users can only delete their own records',
             });
         }
@@ -205,7 +213,8 @@ export function generateRLSPolicies(tables) {
                 name: `${table.name}_all_authenticated`,
                 table: table.name,
                 operation: 'ALL',
-                using: "auth.role() = 'authenticated'",
+                roles: ['authenticated'],
+                using: 'true',
                 justification: 'All CRUD operations require authentication',
             });
         }

package/dist/tools/init-project/result-builder.js

@@ -181,6 +181,8 @@ export function buildInitProjectResult(input) {
                 healthScore: input.healthReport.score,
                 healthSummary: input.healthReport.summary,
                 items: input.healthReport.items,
+                conventionScanStatus: input.conventionScanStatus ?? 'skipped',
+                conventionWarning: buildConventionHealthWarning(input),
             }
             : null,
         feedbackHint: 'Found a bug or have a suggestion? Just say "I want to report a bug" or "I have a suggestion" and Planu will track it for you.',
@@ -256,4 +258,15 @@ export function buildInitProjectResult(input) {
         },
     };
 }
+function buildConventionHealthWarning(input) {
+    const status = input.conventionScanStatus ?? 'skipped';
+    if (status === 'failed') {
+        return 'Convention scan failed; project health may not include all convention violations.';
+    }
+    const conventionItems = input.healthReport?.items.filter((item) => /convention|rule/i.test(item.category) || /convention|rule/i.test(item.message)) ?? [];
+    if (conventionItems.length === 0) {
+        return null;
+    }
+    return `${String(conventionItems.length)} convention-related health warning(s) detected.`;
+}
 //# sourceMappingURL=result-builder.js.map

package/dist/tools/testimonial-handler.js

@@ -13,6 +13,9 @@ function formatTestimonial(t) {
     const github = t.authorGithub ? ` (@${t.authorGithub})` : '';
     return `- "${t.quote}" — ${t.authorName}${github}, ${t.authorRole}${featured} (${t.rating}/5, ${t.locale})`;
 }
+function nonBlank(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
 export async function handleApproveTestimonial(input) {
     const config = await getSupabaseConfig(input.projectPath);
     if (!config) {
@@ -26,23 +29,21 @@ export async function handleApproveTestimonial(input) {
             isError: true,
         };
     }
-    const hasFeedbackId = Boolean(input.feedbackId);
-    const hasManualData = Boolean(input.authorName) && Boolean(input.quote);
-    if (!hasFeedbackId && !hasManualData) {
+    if (!nonBlank(input.authorName) || !nonBlank(input.quote)) {
         return {
             content: [
                 {
                     type: 'text',
-                    text: 'Validation failed: either feedbackId or both authorName and quote are required.',
+                    text: 'Validation failed: authorName and quote are required before approving a testimonial. feedbackId-only approval is not supported yet.',
                 },
             ],
             isError: true,
         };
     }
     const payload = {
-        author_name: input.authorName ?? '',
-        author_role: input.authorRole ?? '',
-        quote: input.quote ?? '',
+        author_name: input.authorName.trim(),
+        author_role: input.authorRole?.trim() ?? '',
+        quote: input.quote.trim(),
         rating: input.rating ?? 5,
         source: input.source ?? 'manual',
         approved: true,
@@ -50,19 +51,19 @@ export async function handleApproveTestimonial(input) {
         locale: input.locale ?? 'en',
     };
     if (input.authorAvatarUrl !== undefined) {
-        payload.author_avatar_url = input.authorAvatarUrl;
+        payload.author_avatar_url = input.authorAvatarUrl.trim();
     }
     if (input.authorGithub !== undefined) {
-        payload.author_github = input.authorGithub;
+        payload.author_github = input.authorGithub.trim();
     }
     if (input.feedbackId !== undefined) {
-        payload.feedback_id = input.feedbackId;
+        payload.feedback_id = input.feedbackId.trim();
     }
     if (input.projectType !== undefined) {
-        payload.project_type = input.projectType;
+        payload.project_type = input.projectType.trim();
     }
     if (input.companySize !== undefined) {
-        payload.company_size = input.companySize;
+        payload.company_size = input.companySize.trim();
     }
     const response = await fetch(TESTIMONIALS_URL(config.projectUrl), {
         method: 'POST',

package/dist/tools/update-status/dod-gates.d.ts

@@ -87,7 +87,7 @@ export declare function checkSpecReviewGate(specId: string, projectId: string, _
  * When force=true, gates are not blocking but failing items are recorded in
  * the project's force-bypass-log.json for traceability (guard: done ≠ implemented).
  */
-export declare function checkDoneGates(spec: Spec, specId: string, projectId: string, projectPath: string | undefined, force: boolean | undefined): Promise<DoneGateResult>;
+export declare function checkDoneGates(spec: Spec, specId: string, projectId: string, projectPath: string | undefined, force: boolean | undefined, forceReason?: string): Promise<DoneGateResult>;
 export interface ComplianceGateResult {
     skipped: boolean;
     score: number | null;

package/dist/tools/update-status/dod-gates.js

@@ -240,7 +240,7 @@ function forceDoneBypassLogPath(projectId) {
  * Writes an audit record when force=true bypasses DoD gates on 'done' transition.
  * Never throws — audit failures must not block transitions.
  */
-async function recordForceDoneBypass(specId, projectId, failingItems, warningItems) {
+async function recordForceDoneBypass(specId, projectId, reason, failingItems, warningItems) {
     try {
         const logPath = forceDoneBypassLogPath(projectId);
         const entries = await readJson(logPath, []);
@@ -250,6 +250,7 @@ async function recordForceDoneBypass(specId, projectId, failingItems, warningIte
             action: 'force_done_bypass',
             specId,
             projectId,
+            reason,
             failingItems,
             warningItems,
         });
@@ -448,7 +449,7 @@ function specReviewGateError(args) {
  * When force=true, gates are not blocking but failing items are recorded in
  * the project's force-bypass-log.json for traceability (guard: done ≠ implemented).
  */
-export async function checkDoneGates(spec, specId, projectId, projectPath, force) {
+export async function checkDoneGates(spec, specId, projectId, projectPath, force, forceReason = 'No force reason provided') {
     if (!force) {
         const dodError = await checkDodGate(spec, specId, projectId, projectPath, false);
         if (dodError) {
@@ -472,7 +473,7 @@ export async function checkDoneGates(spec, specId, projectId, projectPath, force
             .map((i) => i.description);
         if (failingItems.length > 0) {
             // Record bypass in audit log (fire-and-forget)
-            void recordForceDoneBypass(specId, projectId, failingItems, warningItems);
+            void recordForceDoneBypass(specId, projectId, forceReason, failingItems, warningItems);
             forcedBypassWarning =
                 `⚠️ force bypass: ${String(failingItems.length)} DoD item(s) were failing ` +
                     `(${failingItems.slice(0, 2).join('; ')}${failingItems.length > 2 ? '…' : ''}). ` +

package/dist/tools/update-status/index.js

@@ -481,7 +481,7 @@ export async function handleUpdateStatus(params, server) {
                         : Promise.resolve(null),
                     // Done gates: only relevant for 'done'
                     newStatus === 'done'
-                        ? checkDoneGates(spec, specId, projectId, effectiveGatePath, params.force)
+                        ? checkDoneGates(spec, specId, projectId, effectiveGatePath, params.force, params.forceStatusReason ?? params.reason ?? 'No force reason provided')
                         : Promise.resolve(null),
                 ]);
                 // Process code reality result

package/dist/tools/validate.js

@@ -76,30 +76,7 @@ export async function handleValidate(args, server) {
     const implementationQualityScore = calcQualityScore(result.qualityIssues);
     const auditedFiles = [...new Set(result.qualityIssues.map((i) => i.file))];
     // 6. SPEC-190: Convention compliance check
-    let conventionViolations = [];
-    let regressionDetected = false;
-    try {
-        const rules = parseConventions(projectPath);
-        if (rules.length > 0) {
-            conventionViolations = scanConventions(projectPath, rules);
-            // Check regression against baseline
-            const comparison = await compareWithBaseline(projectId, {
-                rules,
-                violations: conventionViolations,
-                summary: {
-                    totalRules: rules.length,
-                    totalViolations: conventionViolations.length,
-                    bySeverity: {},
-                    byCategory: {},
-                },
-                scannedAt: new Date().toISOString(),
-            });
-            regressionDetected = comparison.regressionDetected;
-        }
-    }
-    catch {
-        /* best-effort — don't fail validation */
-    }
+    const { conventionViolations, regressionDetected } = await scanProjectConventions(projectId, projectPath);
     // 7. Lint check (best-effort — non-blocking)
     const lintCheck = runLintCheck(projectPath, knowledge.lintCommand ?? null);
     const assuranceGates = runAssuranceGates(projectPath);
@@ -123,6 +100,14 @@ export async function handleValidate(args, server) {
         conventionRegression: regressionDetected,
         minimalityReport: minimalityReport ?? undefined,
     });
+    const qualityGateSummary = buildQualityGateSummary({
+        conventionViolations,
+        regressionDetected,
+        lintPassed: lintCheck.passed,
+        assurancePassed: assuranceGates.newCode.passed,
+        minimalityBlocked: minimalityReport?.blocked === true,
+        score: result.score,
+    });
     // 8. Build output
     const output = {
         specId,
@@ -198,6 +183,7 @@ export async function handleValidate(args, server) {
         },
         lintCheck,
         assuranceGates,
+        qualityGateSummary,
         validationReport,
         minimalityReport,
         graphCoverage,
@@ -304,8 +290,9 @@ export async function handleValidate(args, server) {
     const passedCount = result.fieldsImplemented;
     const failedCount = totalCriteria - passedCount;
     const indeterminate = result.indeterminate ?? [];
+    const effectiveScore = qualityGateSummary.effectiveScore ?? scoreValue;
     const compactText = buildCompactValidateText({
-        score: scoreValue,
+        score: effectiveScore,
         passedCount,
         failedCount,
         totalCriteria,
@@ -316,7 +303,7 @@ export async function handleValidate(args, server) {
     });
     const graphText = formatGraphCoverageText(graphCoverage);
     // SPEC-512: Compact structuredContent — essential fields only at top level
-    const compactSummary = buildCompactSummary(specId, result.score, passedCount, failedCount, totalCriteria);
+    const compactSummary = buildCompactSummary(specId, result.score === null ? null : effectiveScore, passedCount, failedCount + (qualityGateSummary.passed ? 0 : 1), totalCriteria);
     const structuredBase = { ...outputWithSuggestions, summary: compactSummary, indeterminate };
     // SPEC-595: Elicit next action when validation fails and a server is available
     if (server !== undefined && failedCount > 0) {
@@ -358,6 +345,50 @@ export async function handleValidate(args, server) {
         structuredContent: structuredBase,
     };
 }
+async function scanProjectConventions(projectId, projectPath) {
+    try {
+        const rules = parseConventions(projectPath);
+        if (rules.length === 0) {
+            return { conventionViolations: [], regressionDetected: false };
+        }
+        const conventionViolations = scanConventions(projectPath, rules);
+        const comparison = await compareWithBaseline(projectId, {
+            rules,
+            violations: conventionViolations,
+            summary: {
+                totalRules: rules.length,
+                totalViolations: conventionViolations.length,
+                bySeverity: {},
+                byCategory: {},
+            },
+            scannedAt: new Date().toISOString(),
+        });
+        return { conventionViolations, regressionDetected: comparison.regressionDetected };
+    }
+    catch {
+        return { conventionViolations: [], regressionDetected: false };
+    }
+}
+function buildQualityGateSummary(input) {
+    const blockingConventionViolations = input.conventionViolations.filter((violation) => violation.severity === 'critical');
+    const failures = [
+        ...(input.regressionDetected ? ['convention-regression'] : []),
+        ...(blockingConventionViolations.length > 0 ? ['blocking-convention-violations'] : []),
+        ...(!input.lintPassed ? ['lint'] : []),
+        ...(!input.assurancePassed ? ['assurance'] : []),
+        ...(input.minimalityBlocked ? ['minimality'] : []),
+    ];
+    return {
+        passed: failures.length === 0,
+        effectiveScore: failures.length === 0 ? input.score : Math.min(input.score ?? 0, 99),
+        failures,
+        conventionRegression: input.regressionDetected,
+        blockingConventionViolations: blockingConventionViolations.length,
+        lintPassed: input.lintPassed,
+        assurancePassed: input.assurancePassed,
+        minimalityPassed: !input.minimalityBlocked,
+    };
+}
 function buildCompactSummary(specId, score, passedCount, failedCount, totalCriteria) {
     return {
         specId,

package/dist/types/schema.d.ts

@@ -43,6 +43,7 @@ export interface RLSPolicy {
     name: string;
     table: string;
     operation: 'SELECT' | 'INSERT' | 'UPDATE' | 'DELETE' | 'ALL';
+    roles?: string[];
     using: string;
     withCheck?: string;
     justification: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "4.10.3",
+  "version": "4.10.4",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -34,19 +34,19 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "4.10.3",
-    "@planu/core-darwin-x64": "4.10.3",
-    "@planu/core-linux-arm64-gnu": "4.10.3",
-    "@planu/core-linux-arm64-musl": "4.10.3",
-    "@planu/core-linux-x64-gnu": "4.10.3",
-    "@planu/core-linux-x64-musl": "4.10.3",
-    "@planu/core-win32-arm64-msvc": "4.10.3",
-    "@planu/core-win32-x64-msvc": "4.10.3"
+    "@planu/core-darwin-arm64": "4.10.4",
+    "@planu/core-darwin-x64": "4.10.4",
+    "@planu/core-linux-arm64-gnu": "4.10.4",
+    "@planu/core-linux-arm64-musl": "4.10.4",
+    "@planu/core-linux-x64-gnu": "4.10.4",
+    "@planu/core-linux-x64-musl": "4.10.4",
+    "@planu/core-win32-arm64-msvc": "4.10.4",
+    "@planu/core-win32-x64-msvc": "4.10.4"
   },
   "engines": {
     "node": ">=24.0.0"
   },
-  "packageManager": "pnpm@10.28.2",
+  "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b",
   "scripts": {
     "build:rust": "bash scripts/build-rust-local.sh --host",
     "build:rust:all": "bash scripts/build-rust-local.sh --all",
@@ -135,38 +135,6 @@
     "yaml": "^2.9.0",
     "zod": "^4.4.3"
   },
-  "pnpm": {
-    "overrides": {
-      "flatted": ">=3.4.2",
-      "path-to-regexp": ">=8.4.0",
-      "brace-expansion": ">=5.0.5",
-      "handlebars": ">=4.7.9",
-      "picomatch": ">=4.0.4",
-      "yaml": ">=2.8.3",
-      "lodash": ">=4.18.0",
-      "lodash-es": ">=4.18.0",
-      "hono": ">=4.12.14",
-      "postcss": ">=8.5.10",
-      "esbuild": "0.28.1",
-      "fast-uri": ">=3.1.2",
-      "qs": ">=6.15.2"
-    },
-    "supportedArchitectures": {
-      "os": [
-        "darwin",
-        "linux",
-        "win32"
-      ],
-      "cpu": [
-        "arm64",
-        "x64"
-      ],
-      "libc": [
-        "glibc",
-        "musl"
-      ]
-    }
-  },
   "devDependencies": {
     "@commitlint/cli": "^21.2.0",
     "@commitlint/config-conventional": "^21.2.0",
@@ -200,7 +168,7 @@
     "prettier": "^3.9.4",
     "secretlint": "^13.0.2",
     "semantic-release": "^25.0.5",
-    "tsc-alias": "^1.8.17",
+    "tsc-alias": "^1.9.0",
     "type-coverage": "^2.29.7",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.62.1",

package/planu-native.json

@@ -1,7 +1,7 @@
 {
   "name": "dev.planu.native",
   "displayName": "Planu Native Lightweight Surface",
-  "version": "4.10.3",
+  "version": "4.10.4",
   "packageName": "@planu/cli",
   "modes": {
     "lightweight": {

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "4.10.3",
+  "version": "4.10.4",
   "icon": "assets/plugin/icon.svg",
   "command": [
     "npx",