@planu/cli 4.10.4 → 4.10.5

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [4.10.5] - 2026-07-07
+
+### Bug Fixes
+- fix(SPEC-1109): resolve audit backlog
+
+
 ## [4.10.4] - 2026-07-06
 
 ### Bug Fixes

package/dist/config/version.js

@@ -1,4 +1,4 @@
-// version.ts — reads from package.json at runtime; updated automatically by semantic-release
+// version.ts — reads from package.json at runtime; updated by the local release flow
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';

package/dist/config/version.ts

@@ -1,4 +1,4 @@
-// version.ts — reads from package.json at runtime; updated automatically by semantic-release
+// version.ts — reads from package.json at runtime; updated by the local release flow
 
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';

package/dist/engine/project-graph/extractors/decision-store-extractor.js

@@ -1,6 +1,6 @@
 import { safeJsonParse } from '../../../storage/base-store.js';
 import { hashText } from '../cache.js';
-import { redactGraphText } from '../query.js';
+import { redactGraphText } from '../redaction.js';
 function isDecision(value) {
     return (value !== null &&
         typeof value === 'object' &&

package/dist/engine/project-graph/extractors/git-extractor.js

@@ -1,6 +1,6 @@
 import { promisify } from 'node:util';
 import { hashText } from '../cache.js';
-import { redactGraphText } from '../query.js';
+import { redactGraphText } from '../redaction.js';
 export async function extractGitGraph(args) {
     try {
         const childProcess = await import('node:child_process');

package/dist/engine/project-graph/extractors/handoff-extractor.js

@@ -1,5 +1,5 @@
 import { hashText } from '../cache.js';
-import { redactGraphText } from '../query.js';
+import { redactGraphText } from '../redaction.js';
 function specIdFromPath(path) {
     return path.split('/').find((part) => /^SPEC-\d+$/i.test(part));
 }

package/dist/engine/project-graph/extractors/spec-extractor.js

@@ -1,6 +1,6 @@
 import YAML from 'yaml';
 import { hashText } from '../cache.js';
-import { redactGraphText } from '../query.js';
+import { redactGraphText } from '../redaction.js';
 function frontmatter(content) {
     if (!content.startsWith('---')) {
         return {};

package/dist/engine/project-graph/extractors/validation-extractor.js

@@ -1,5 +1,5 @@
 import { hashText } from '../cache.js';
-import { redactGraphText } from '../query.js';
+import { redactGraphText } from '../redaction.js';
 function specIdFromPath(path) {
     return path.split('/').find((part) => /^SPEC-\d+$/i.test(part));
 }

package/dist/engine/project-graph/index.d.ts

@@ -1,4 +1,5 @@
 export { buildProjectKnowledgeGraph } from './builder.js';
-export { queryProjectGraphSlice, formatProjectGraphContext, getProjectGraphFreshnessHint, redactGraphText, } from './query.js';
+export { queryProjectGraphSlice, formatProjectGraphContext, getProjectGraphFreshnessHint, } from './query.js';
+export { redactGraphText } from './redaction.js';
 export { getProjectGraphFreshness, loadProjectGraphPolicy, projectGraphPath, projectGraphCachePath, } from './cache.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/engine/project-graph/index.js

@@ -1,4 +1,5 @@
 export { buildProjectKnowledgeGraph } from './builder.js';
-export { queryProjectGraphSlice, formatProjectGraphContext, getProjectGraphFreshnessHint, redactGraphText, } from './query.js';
+export { queryProjectGraphSlice, formatProjectGraphContext, getProjectGraphFreshnessHint, } from './query.js';
+export { redactGraphText } from './redaction.js';
 export { getProjectGraphFreshness, loadProjectGraphPolicy, projectGraphPath, projectGraphCachePath, } from './cache.js';
 //# sourceMappingURL=index.js.map

package/dist/engine/project-graph/query.d.ts

@@ -1,5 +1,4 @@
-import type { ProjectGraphPolicy, ProjectGraphQueryInput, ProjectGraphSlice } from '../../types/project-knowledge-graph.js';
-export declare function redactGraphText(text: string, policy: ProjectGraphPolicy, maxChars?: number): string;
+import type { ProjectGraphQueryInput, ProjectGraphSlice } from '../../types/project-knowledge-graph.js';
 export declare function queryProjectGraphSlice(input: ProjectGraphQueryInput): Promise<ProjectGraphSlice | null>;
 export declare function formatProjectGraphContext(slice: ProjectGraphSlice): Promise<string>;
 export declare function getProjectGraphFreshnessHint(args: {

package/dist/engine/project-graph/query.js

@@ -1,16 +1,7 @@
 import { hashProjectPath } from '../../storage/base-store.js';
 import { buildProjectKnowledgeGraph } from './builder.js';
 import { getProjectGraphFreshness, loadProjectGraphPolicy, readProjectGraph } from './cache.js';
-function escapeInert(text) {
-    return text.replace(/</g, '&lt;').replace(/>/g, '&gt;');
-}
-export function redactGraphText(text, policy, maxChars = policy.redaction.maxSnippetChars) {
-    const truncated = text.slice(0, maxChars);
-    return policy.redaction.redactPatterns.reduce((current, pattern) => {
-        const re = new RegExp(pattern, 'gi');
-        return current.replace(re, '[redacted]');
-    }, truncated);
-}
+import { escapeInert, redactGraphText } from './redaction.js';
 function sanitizeLabel(label, policy) {
     return escapeInert(redactGraphText(label, policy));
 }

package/dist/engine/project-graph/redaction.d.ts

@@ -0,0 +1,4 @@
+import type { ProjectGraphPolicy } from '../../types/project-knowledge-graph.js';
+export declare function escapeInert(text: string): string;
+export declare function redactGraphText(text: string, policy: ProjectGraphPolicy, maxChars?: number): string;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/engine/project-graph/redaction.js

@@ -0,0 +1,11 @@
+export function escapeInert(text) {
+    return text.replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+export function redactGraphText(text, policy, maxChars = policy.redaction.maxSnippetChars) {
+    const truncated = text.slice(0, maxChars);
+    return policy.redaction.redactPatterns.reduce((current, pattern) => {
+        const re = new RegExp(pattern, 'gi');
+        return current.replace(re, '[redacted]');
+    }, truncated);
+}
+//# sourceMappingURL=redaction.js.map

package/dist/engine/validator/validation-report-writer.js

@@ -1,15 +1,16 @@
-import { appendArtifact } from '../handoff-artifacts/io.js';
+import { appendArtifact, readArtifact } from '../handoff-artifacts/io.js';
 import { runSpecCompliance, } from './spec-compliance-runner.js';
 export async function writeImplementationReviewReport(input) {
     const specCompliance = await runSpecCompliance(input.spec, input.projectPath);
     const gates = buildGates({
         score: input.score,
-        lintPassed: input.lintPassed ?? true,
+        lintPassed: input.lintPassed,
         conventionRegression: input.conventionRegression ?? false,
         specCompliance,
         minimalityReport: input.minimalityReport,
     });
-    const passed = gates.every((gate) => gate.passed);
+    const mergedGates = await preserveUnobservedBlockingGates(input, gates);
+    const passed = mergedGates.every((gate) => gate.passed);
     const reviewer = {
         kind: 'implementation-review-agent',
         agent: 'planu-implementation-reviewer',
@@ -20,7 +21,7 @@ export async function writeImplementationReviewReport(input) {
         schema_version: '1.0.0',
         specId: input.specId,
         passed,
-        gates,
+        gates: mergedGates,
         reviewer,
         specCompliance: reportCompliance,
         minimalityReport: input.minimalityReport,
@@ -40,7 +41,7 @@ export async function writeImplementationReviewReport(input) {
             sha: artifact.sha,
             reviewer,
             passed,
-            gates,
+            gates: mergedGates,
             specCompliance: reportCompliance,
         };
     }
@@ -50,11 +51,38 @@ export async function writeImplementationReviewReport(input) {
             error: err instanceof Error ? err.message : String(err),
             reviewer,
             passed,
-            gates,
+            gates: mergedGates,
             specCompliance: reportCompliance,
         };
     }
 }
+async function preserveUnobservedBlockingGates(input, nextGates) {
+    const currentGateNames = new Set(nextGates.map((gate) => gate.name));
+    const explicitlyObserved = new Set([
+        ...(input.lintPassed !== undefined ? ['lint'] : []),
+        ...(input.conventionRegression !== undefined ? ['convention-regression'] : []),
+        ...(input.minimalityReport !== undefined ? ['minimal-implementation'] : []),
+    ]);
+    const existing = await readArtifact({
+        projectId: input.projectId,
+        specId: input.specId,
+        kind: 'validation-report',
+    }).catch(() => null);
+    if (!existing?.ok) {
+        return nextGates;
+    }
+    const preserved = existing.payload.gates.filter((gate) => !gate.passed &&
+        currentGateNames.has(gate.name) &&
+        !explicitlyObserved.has(gate.name) &&
+        (gate.name === 'lint' ||
+            gate.name === 'convention-regression' ||
+            gate.name === 'minimal-implementation'));
+    if (preserved.length === 0) {
+        return nextGates;
+    }
+    const preservedByName = new Map(preserved.map((gate) => [gate.name, gate]));
+    return nextGates.map((gate) => preservedByName.get(gate.name) ?? gate);
+}
 function buildGates(args) {
     return [
         {
@@ -66,8 +94,12 @@ function buildGates(args) {
         },
         {
             name: 'lint',
-            passed: args.lintPassed,
-            reason: args.lintPassed ? undefined : 'Configured lint command failed.',
+            passed: args.lintPassed === true,
+            reason: args.lintPassed === true
+                ? undefined
+                : args.lintPassed === false
+                    ? 'Configured lint command failed.'
+                    : 'Lint result was not provided; report cannot claim lint passed.',
         },
         {
             name: 'convention-regression',

package/dist/tools/design-schema-sql/migrations.js

@@ -63,11 +63,16 @@ export function generateMigrations(tables, indexes, rlsPolicies, engine) {
         }
         for (const policy of rlsPolicies) {
             const rolesClause = policy.roles?.length ? ` TO ${policy.roles.join(', ')}` : '';
-            const usingClause = `USING (${policy.using})`;
-            const withCheckClause = policy.withCheck ? ` WITH CHECK (${policy.withCheck})` : '';
+            const usingClause = policy.operation === 'INSERT' ? '' : ` USING (${policy.using})`;
+            const withCheckClause = policy.withCheck || policy.operation === 'INSERT'
+                ? ` WITH CHECK (${policy.withCheck ?? policy.using})`
+                : '';
+            const policyClauses = [rolesClause, usingClause, withCheckClause]
+                .filter((clause) => clause.length > 0)
+                .join('');
             migrations.push({
                 order: order++,
-                sql: `CREATE POLICY ${policy.name} ON ${policy.table} FOR ${policy.operation}${rolesClause} ${usingClause}${withCheckClause};`,
+                sql: `CREATE POLICY ${policy.name} ON ${policy.table} FOR ${policy.operation}${policyClauses};`,
                 reversible: true,
                 reverseSql: `DROP POLICY IF EXISTS ${policy.name} ON ${policy.table};`,
                 dataLoss: false,

package/dist/tools/design-schema-sql/tables.js

@@ -210,12 +210,28 @@ export function generateRLSPolicies(tables) {
         }
         else {
             policies.push({
-                name: `${table.name}_all_authenticated`,
+                name: `${table.name}_insert_authenticated`,
                 table: table.name,
-                operation: 'ALL',
+                operation: 'INSERT',
+                roles: ['authenticated'],
+                using: 'true',
+                withCheck: 'true',
+                justification: 'Authenticated users can insert records',
+            }, {
+                name: `${table.name}_update_authenticated`,
+                table: table.name,
+                operation: 'UPDATE',
+                roles: ['authenticated'],
+                using: 'true',
+                withCheck: 'true',
+                justification: 'Authenticated users can update records',
+            }, {
+                name: `${table.name}_delete_authenticated`,
+                table: table.name,
+                operation: 'DELETE',
                 roles: ['authenticated'],
                 using: 'true',
-                justification: 'All CRUD operations require authentication',
+                justification: 'Authenticated users can delete records',
             });
         }
     }

package/dist/tools/validate-lint.js

@@ -55,7 +55,7 @@ export function runLintCheck(projectPath, lintCommand) {
             const output = `Lint command timed out after ${String(seconds)}s and was skipped so validate can complete within MCP request limits. ` +
                 `Run \`${plan.executedCommand}\` manually before marking the spec done.`;
             console.warn(`[Planu] lintCheck timed out: command="${plan.executedCommand}" cwd="${projectPath}" timeoutMs=${String(LINT_CHECK_TIMEOUT_MS)}`);
-            return { passed: true, command, issueCount: 0, output };
+            return { passed: false, command, issueCount: 1, output };
         }
         const raw = commandOutput(err);
         const output = formatLintFailureDiagnostics(plan, raw);

package/dist/tools/validate.js

@@ -296,6 +296,7 @@ export async function handleValidate(args, server) {
         passedCount,
         failedCount,
         totalCriteria,
+        qualityFailures: qualityGateSummary.failures,
         missing: result.missing,
         indeterminate,
         commitReminder,
@@ -400,13 +401,18 @@ function buildCompactSummary(specId, score, passedCount, failedCount, totalCrite
     };
 }
 function buildCompactValidateText(args) {
-    const { score, passedCount, failedCount, totalCriteria, missing, indeterminate, commitReminder, planuReminder, } = args;
-    if (failedCount === 0) {
+    const { score, passedCount, failedCount, totalCriteria, qualityFailures, missing, indeterminate, commitReminder, planuReminder, } = args;
+    if (failedCount === 0 && qualityFailures.length === 0) {
         // All passing — single line
         return (`✅ Validate: ${String(score)}/100 — ${String(passedCount)}/${String(totalCriteria)} criteria passing` +
             commitReminder +
             planuReminder);
     }
+    if (failedCount === 0) {
+        return (`❌ Validate: ${String(score)}/100 — failing; ${String(passedCount)}/${String(totalCriteria)} criteria passing; failing gates: ${qualityFailures.join(', ')}` +
+            commitReminder +
+            planuReminder);
+    }
     // Failures exist — list only the failing ones (max 5)
     const MAX_FAILURES = 5;
     const labelledFailures = [
@@ -423,7 +429,8 @@ function buildCompactValidateText(args) {
         .slice(0, 3)
         .map((failure) => `${failure.label}: ${failure.criterion}`)
         .join(', ');
-    const summaryLine = `❌ Validate: ${String(score)}/100 — ${String(failedCount)} failing: [${failNames}${remainingCount + shownFailures.length > 3 ? '...' : ''}]`;
+    const gateSuffix = qualityFailures.length > 0 ? `; failing gates: ${qualityFailures.join(', ')}` : '';
+    const summaryLine = `❌ Validate: ${String(score)}/100 — failing; ${String(failedCount)} failing criteria: [${failNames}${remainingCount + shownFailures.length > 3 ? '...' : ''}]${gateSuffix}`;
     return summaryLine + '\n' + failureList + moreLine + commitReminder + planuReminder;
 }
 function scoreToGrade(score) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "4.10.4",
+  "version": "4.10.5",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -34,14 +34,14 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "4.10.4",
-    "@planu/core-darwin-x64": "4.10.4",
-    "@planu/core-linux-arm64-gnu": "4.10.4",
-    "@planu/core-linux-arm64-musl": "4.10.4",
-    "@planu/core-linux-x64-gnu": "4.10.4",
-    "@planu/core-linux-x64-musl": "4.10.4",
-    "@planu/core-win32-arm64-msvc": "4.10.4",
-    "@planu/core-win32-x64-msvc": "4.10.4"
+    "@planu/core-darwin-arm64": "4.10.5",
+    "@planu/core-darwin-x64": "4.10.5",
+    "@planu/core-linux-arm64-gnu": "4.10.5",
+    "@planu/core-linux-arm64-musl": "4.10.5",
+    "@planu/core-linux-x64-gnu": "4.10.5",
+    "@planu/core-linux-x64-musl": "4.10.5",
+    "@planu/core-win32-arm64-msvc": "4.10.5",
+    "@planu/core-win32-x64-msvc": "4.10.5"
   },
   "engines": {
     "node": ">=24.0.0"
@@ -142,18 +142,12 @@
     "@napi-rs/cli": "^3.7.2",
     "@secretlint/secretlint-rule-no-homedir": "^13.0.2",
     "@secretlint/secretlint-rule-preset-recommend": "^13.0.2",
-    "@semantic-release/changelog": "^6.0.3",
-    "@semantic-release/commit-analyzer": "^13.0.1",
-    "@semantic-release/git": "^10.0.1",
-    "@semantic-release/github": "^12.0.9",
-    "@semantic-release/npm": "^13.1.5",
-    "@semantic-release/release-notes-generator": "^14.1.1",
     "@stryker-mutator/core": "^9.6.1",
     "@stryker-mutator/vitest-runner": "^9.6.1",
     "@supabase/supabase-js": "^2.110.0",
     "@types/node": "^26.1.0",
     "@vitejs/plugin-vue": "^6.0.7",
-    "@vitest/coverage-v8": "^4.1.9",
+    "@vitest/coverage-v8": "^4.1.10",
     "@vue/test-utils": "^2.4.11",
     "eslint": "^10.6.0",
     "eslint-config-prettier": "^10.1.8",
@@ -167,13 +161,12 @@
     "madge": "^8.0.0",
     "prettier": "^3.9.4",
     "secretlint": "^13.0.2",
-    "semantic-release": "^25.0.5",
     "tsc-alias": "^1.9.0",
     "type-coverage": "^2.29.7",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.62.1",
     "vite": "^8.1.3",
-    "vitest": "^4.1.9",
+    "vitest": "^4.1.10",
     "vue": "^3.5.39"
   }
 }

package/planu-native.json

@@ -1,7 +1,7 @@
 {
   "name": "dev.planu.native",
   "displayName": "Planu Native Lightweight Surface",
-  "version": "4.10.4",
+  "version": "4.10.5",
   "packageName": "@planu/cli",
   "modes": {
     "lightweight": {

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "4.10.4",
+  "version": "4.10.5",
   "icon": "assets/plugin/icon.svg",
   "command": [
     "npx",

package/dist/engine/context-artifacts/index.d.ts

@@ -1,2 +0,0 @@
-export { getContextArtifactStats, retrieveContextArtifact, storeContextArtifact } from './store.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/engine/context-artifacts/index.js

@@ -1,2 +0,0 @@
-export { getContextArtifactStats, retrieveContextArtifact, storeContextArtifact } from './store.js';
-//# sourceMappingURL=index.js.map