@planu/cli 4.11.6 → 4.11.8

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## [4.11.8] - 2026-07-20
+
+### Bug Fixes
+- fix: make pre-commit checks fail closed
+- fix: pin release-eligible transitive dependencies
+- fix: sync release lockfile before build
+- fix: stabilize quality gate execution
+- fix: harden lifecycle and release reliability
+
+
+## [4.11.7] - 2026-07-18
+
+### Bug Fixes
+- fix: harden shell execution paths
+
+
 ## [4.11.6] - 2026-07-18
 
 ### Bug Fixes

package/dist/cli/commands/serve.js

@@ -29,6 +29,10 @@ export const serveCommand = {
         registerSpecTools(server);
         registerPlatformTools(server);
         await selectTransport(server, ['--transport', 'http', '--port', port], () => server);
+        const { recoverPendingPostCommitTasksAtStartup } = await import('../../tools/update-status/index.js');
+        void recoverPendingPostCommitTasksAtStartup().catch((error) => {
+            process.stderr.write(`Planu post-commit recovery failed: ${error instanceof Error ? error.message : String(error)}\n`);
+        });
     },
 };
 //# sourceMappingURL=serve.js.map

package/dist/config/license-plans.json

@@ -81,6 +81,7 @@
     "discover_docs_url",
     "discover_mcps",
     "discover_registry",
+    "dogfood_watch",
     "ears_lint",
     "ecosystem_status",
     "enable_auto_update",

package/dist/engine/actuals/git-analyzer.js

@@ -1,7 +1,7 @@
 // Planu — engine/actuals/git-analyzer.ts (SPEC-061)
 // Derives actuals from git log history for a given spec.
-import { execSync } from 'node:child_process';
-const SPEC_ID_PATTERN = /^SPEC-\d+$/;
+import { execFileSync } from 'node:child_process';
+import { isCanonicalSpecId } from '../../tools/schemas/spec-id.js';
 const MAX_SESSION_GAP_MS = 2 * 60 * 60 * 1000; // 2 hours
 const REVIEW_HOURS_RATIO = 0.15;
 const MINIMUM_DEV_HOURS = 1;
@@ -121,7 +121,7 @@ export function calculateLinesChanged(commits) {
  * Returns null if specId is invalid or no commits are found.
  */
 export function deriveActualsFromGit(projectPath, specId) {
-    if (!SPEC_ID_PATTERN.test(specId)) {
+    if (!isCanonicalSpecId(specId)) {
         return Promise.resolve(null);
     }
     const gitOutput = runGitLog(projectPath, specId);
@@ -155,7 +155,7 @@ export function deriveActualsFromGit(projectPath, specId) {
 }
 function runGitLog(projectPath, specId) {
     try {
-        const result = execSync(`git log --format="%H|%aI|%s" --numstat --all --grep="${specId}"`, {
+        const result = execFileSync('git', ['log', '--format=%H|%aI|%s', '--numstat', '--all', '--grep', specId], {
             cwd: projectPath,
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],

package/dist/engine/browser-validator.js

@@ -87,62 +87,67 @@ export function extractUIAssertions(criteriaMarkdown) {
     }
     return assertions;
 }
-/** Escape a string for use inside a JS template literal. */
-function escapeTemplateLiteral(str) {
-    return str.replace(/\\/g, '\\\\').replace(/`/g, '\\`').replace(/\$\{/g, '\\${');
+function escapeRegExpLiteral(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function safeComment(value) {
+    return value.replace(/[\r\n\u2028\u2029]+/g, ' ');
 }
 /**
  * Generate a complete Playwright test file content from UI assertions.
  * Uses @playwright/test syntax with test.step() per assertion.
  */
 export function generatePlaywrightTest(assertions, specId, baseUrl) {
+    const manualStep = (message) => `throw new Error(${JSON.stringify(message)});`;
     const steps = assertions.map((a, i) => {
-        const stepName = escapeTemplateLiteral(a.criterion);
-        const locator = a.locator ? escapeTemplateLiteral(a.locator) : null;
+        const stepName = JSON.stringify(`${String(i + 1)}. ${a.criterion}`);
+        const locator = a.locator ? JSON.stringify(a.locator) : null;
         let body;
         switch (a.type) {
             case 'visibility':
                 body = locator
-                    ? `await expect(page.locator(\`${locator}\`)).toBeVisible();`
-                    : `// TODO: add locator for: ${a.criterion}`;
+                    ? `await expect(page.locator(${locator})).toBeVisible();`
+                    : manualStep(`Manual locator required for visibility assertion: ${a.criterion}`);
                 break;
             case 'text':
                 body =
                     locator && a.expected
-                        ? `await expect(page.locator(\`${locator}\`)).toContainText(\`${escapeTemplateLiteral(a.expected)}\`);`
+                        ? `await expect(page.locator(${locator})).toContainText(${JSON.stringify(a.expected)});`
                         : locator
-                            ? `await expect(page.locator(\`${locator}\`)).toBeVisible();`
-                            : `// TODO: verify text for: ${a.criterion}`;
+                            ? `await expect(page.locator(${locator})).toBeVisible();`
+                            : manualStep(`Manual text verification required: ${a.criterion}`);
                 break;
             case 'navigation':
                 body = a.expected
-                    ? `await expect(page).toHaveURL(/${escapeTemplateLiteral(a.expected)}/);`
-                    : `// TODO: verify navigation for: ${a.criterion}`;
+                    ? `await expect(page).toHaveURL(new RegExp(${JSON.stringify(escapeRegExpLiteral(a.expected))}));`
+                    : manualStep(`Manual navigation verification required: ${a.criterion}`);
                 break;
             case 'form':
                 body = locator
-                    ? `await expect(page.locator(\`${locator}\`)).toBeVisible();`
-                    : `// TODO: interact with form for: ${a.criterion}`;
+                    ? `await expect(page.locator(${locator})).toBeVisible();`
+                    : manualStep(`Manual form interaction required: ${a.criterion}`);
                 break;
             case 'generic':
-                body = `// TODO: verify: ${a.criterion}`;
+                body = manualStep(`Manual assertion required: ${a.criterion}`);
                 break;
             default: {
                 const _exhaustive = a.type;
-                body = `// TODO: verify: ${String(_exhaustive)}`;
+                body = manualStep(`Unsupported assertion type requires manual validation: ${String(_exhaustive)}`);
             }
         }
-        return `    await test.step('${String(i + 1)}. ${stepName}', async () => {\n      ${body}\n    });`;
+        return `    await test.step(${stepName}, async () => {\n      ${body}\n    });`;
     });
+    const testTitle = JSON.stringify(`${specId} — UI acceptance criteria`);
+    const serializedBaseUrl = JSON.stringify(baseUrl);
     return [
         `import { test, expect } from '@playwright/test';`,
         ``,
         `// Generated by Planu — SPEC-308 browser validator`,
-        `// Spec: ${specId}`,
-        `// Base URL: ${baseUrl}`,
+        `// Spec: ${safeComment(specId)}`,
+        `// Base URL: ${safeComment(baseUrl)}`,
         ``,
-        `test('${specId} — UI acceptance criteria', async ({ page }) => {`,
-        `  await page.goto('${baseUrl}');`,
+        `test(${testTitle}, async ({ page }) => {`,
+        `  await page.goto(${serializedBaseUrl});`,
         ``,
         ...steps,
         `});`,

package/dist/engine/crash-shield/file-collector.d.ts

@@ -1,10 +1,27 @@
 import type { FileCollectionResult } from '../../types/index.js';
 export type { FileCollectionResult };
+export declare const DEFAULT_FILE_COLLECTION_BUDGET: Readonly<{
+    maxFiles: 1000;
+    maxBytes: number;
+}>;
 /**
- * Collects files from the project path, detects the stack, and returns up to MAX_FILES paths.
- * Optionally filters by enabled languages.
+ * Collects eligible runtime files in deterministic order within an explicit budget.
+ * Coverage metadata makes every partial collection visible to callers.
  */
-export declare function collectFiles(projectPath: string, enabledLanguages?: string[]): Promise<FileCollectionResult>;
+export declare function collectFiles(projectPath: string, enabledLanguages?: string[], budget?: {
+    maxFiles?: number;
+    maxBytes?: number;
+}): Promise<FileCollectionResult & {
+    coverage: {
+        complete: boolean;
+        discoveredFiles: number;
+        selectedFiles: number;
+        selectedBytes: number;
+        maxFiles: number;
+        maxBytes: number;
+        truncatedBy: ('file-count' | 'byte-budget' | 'metadata-error')[];
+    };
+}>;
 /**
  * Processes items in sequential batches to avoid unbounded concurrency.
  * Each batch runs in parallel internally, but batches are processed one at a time.

package/dist/engine/crash-shield/file-collector.js

@@ -1,6 +1,11 @@
 // engine/crash-shield/file-collector.ts — File discovery for crash shield (SPEC-442)
 import { glob } from 'glob';
-import { join } from 'node:path';
+import { stat } from 'node:fs/promises';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+export const DEFAULT_FILE_COLLECTION_BUDGET = Object.freeze({
+    maxFiles: 1_000,
+    maxBytes: 50 * 1024 * 1024,
+});
 const STACK_EXTENSIONS = {
     TypeScript: ['.ts', '.tsx'],
     JavaScript: ['.js', '.jsx', '.mjs', '.cjs'],
@@ -11,30 +16,154 @@ const STACK_EXTENSIONS = {
     PHP: ['.php'],
     Ruby: ['.rb'],
 };
-const MAX_FILES = 400;
 const IGNORE_PATTERNS = [
     '**/node_modules/**',
+    '**/vendor/**',
     '**/dist/**',
+    '**/build/**',
+    '**/target/**',
+    '**/coverage/**',
+    '**/.next/**',
+    '**/.nuxt/**',
+    '**/.cache/**',
     '**/.git/**',
+    '**/tests/**',
+    '**/test/**',
+    '**/__tests__/**',
+    '**/fixtures/**',
+    '**/__fixtures__/**',
+    '**/generated/**',
+    '**/*.test.*',
+    '**/*.spec.*',
+    '**/test_*.py',
+    '**/*_test.go',
     '**/*.d.ts',
     '**/*.min.js',
 ];
 /**
- * Collects files from the project path, detects the stack, and returns up to MAX_FILES paths.
- * Optionally filters by enabled languages.
+ * Collects eligible runtime files in deterministic order within an explicit budget.
+ * Coverage metadata makes every partial collection visible to callers.
  */
-export async function collectFiles(projectPath, enabledLanguages) {
+export async function collectFiles(projectPath, enabledLanguages, budget = {}) {
     const extensions = buildExtensionList(enabledLanguages);
     const pattern = buildGlobPattern(extensions);
+    const limits = normalizeBudget(budget);
     const allFiles = await glob(pattern, {
         cwd: projectPath,
         ignore: IGNORE_PATTERNS,
         absolute: true,
         nodir: true,
     });
-    const files = allFiles.slice(0, MAX_FILES).map((f) => join(f));
-    const detectedStack = detectStack(files);
-    return { files, detectedStack };
+    const eligibleFiles = normalizeEligibleFiles(projectPath, allFiles);
+    const detectedStack = detectStack(eligibleFiles);
+    const files = [];
+    let selectedBytes = 0;
+    let metadataErrors = 0;
+    let byteBudgetReached = false;
+    for (const file of eligibleFiles) {
+        if (files.length >= limits.maxFiles) {
+            break;
+        }
+        let fileBytes;
+        try {
+            fileBytes = (await stat(join(projectPath, file))).size;
+        }
+        catch {
+            metadataErrors += 1;
+            continue;
+        }
+        if (selectedBytes + fileBytes > limits.maxBytes) {
+            byteBudgetReached = true;
+            break;
+        }
+        files.push(file);
+        selectedBytes += fileBytes;
+    }
+    const truncatedBy = [];
+    if (files.length + metadataErrors < eligibleFiles.length && files.length >= limits.maxFiles) {
+        truncatedBy.push('file-count');
+    }
+    if (byteBudgetReached) {
+        truncatedBy.push('byte-budget');
+    }
+    if (metadataErrors > 0) {
+        truncatedBy.push('metadata-error');
+    }
+    return {
+        files,
+        detectedStack,
+        coverage: {
+            complete: truncatedBy.length === 0,
+            discoveredFiles: eligibleFiles.length,
+            selectedFiles: files.length,
+            selectedBytes,
+            maxFiles: limits.maxFiles,
+            maxBytes: limits.maxBytes,
+            truncatedBy,
+        },
+    };
+}
+function normalizeEligibleFiles(projectPath, files) {
+    return [
+        ...new Set(files
+            .map((file) => normalizeProjectRelativePath(projectPath, file))
+            .filter((file) => file !== null)
+            .filter(isRuntimeSourcePath)),
+    ].sort((left, right) => left.localeCompare(right));
+}
+function normalizeProjectRelativePath(projectPath, filePath) {
+    const projectRoot = resolve(projectPath);
+    const absolutePath = isAbsolute(filePath) ? resolve(filePath) : resolve(projectRoot, filePath);
+    const relativePath = relative(projectRoot, absolutePath);
+    if (relativePath.length === 0 ||
+        relativePath === '..' ||
+        relativePath.startsWith(`..${sep}`) ||
+        isAbsolute(relativePath)) {
+        return null;
+    }
+    return relativePath;
+}
+function normalizeBudget(budget) {
+    return {
+        maxFiles: normalizePositiveInteger(budget.maxFiles, DEFAULT_FILE_COLLECTION_BUDGET.maxFiles),
+        maxBytes: normalizePositiveInteger(budget.maxBytes, DEFAULT_FILE_COLLECTION_BUDGET.maxBytes),
+    };
+}
+function normalizePositiveInteger(value, fallback) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0
+        ? Math.floor(value)
+        : fallback;
+}
+function isRuntimeSourcePath(filePath) {
+    const normalized = filePath.replaceAll('\\', '/');
+    const segments = normalized.split('/');
+    const excludedDirectories = new Set([
+        'node_modules',
+        'vendor',
+        'dist',
+        'build',
+        'target',
+        'coverage',
+        '.next',
+        '.nuxt',
+        '.cache',
+        '.git',
+        'tests',
+        'test',
+        '__tests__',
+        'fixtures',
+        '__fixtures__',
+        'generated',
+    ]);
+    if (segments.some((segment) => excludedDirectories.has(segment))) {
+        return false;
+    }
+    const fileName = segments.at(-1) ?? '';
+    return (!/\.(?:test|spec)\.[^.]+$/i.test(fileName) &&
+        !/^test_.*\.py$/i.test(fileName) &&
+        !/_test\.go$/i.test(fileName) &&
+        !/\.d\.ts$/i.test(fileName) &&
+        !/\.min\.js$/i.test(fileName));
 }
 function buildExtensionList(enabledLanguages) {
     if (!enabledLanguages || enabledLanguages.length === 0) {

package/dist/engine/crash-shield/index.d.ts

@@ -4,6 +4,23 @@ export { fixCrashRisks } from './auto-fixer/index.js';
  * Scans a project for crash risks and returns a SafetyReport.
  * @param projectPath - absolute path to the project root
  * @param stackHint - optional list of languages to restrict scanning (e.g. ['TypeScript'])
+ * @param options - optional file, byte, and read-batch budgets
  */
-export declare function scanCrashRisks(projectPath: string, stackHint?: string[]): Promise<SafetyReport>;
+export declare function scanCrashRisks(projectPath: string, stackHint?: string[], options?: {
+    maxFiles?: number;
+    maxBytes?: number;
+    readBatchSize?: number;
+}): Promise<SafetyReport & {
+    coverage: {
+        complete: boolean;
+        discoveredFiles: number;
+        selectedFiles: number;
+        selectedBytes: number;
+        maxFiles: number;
+        maxBytes: number;
+        truncatedBy: ('file-count' | 'byte-budget' | 'metadata-error')[];
+        scannedFiles: number;
+        unreadableFiles: number;
+    };
+}>;
 //# sourceMappingURL=index.d.ts.map

package/dist/engine/crash-shield/index.js

@@ -1,4 +1,5 @@
 import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
 import { collectFiles } from './file-collector.js';
 import { calculateScore } from './score-calculator.js';
 import { typescriptDetector } from './detectors/typescript-detector.js';
@@ -17,41 +18,81 @@ const ALL_DETECTORS = [
     javaDetector,
     frameworkDetector,
 ];
+const DEFAULT_READ_BATCH_SIZE = 50;
 /**
  * Scans a project for crash risks and returns a SafetyReport.
  * @param projectPath - absolute path to the project root
  * @param stackHint - optional list of languages to restrict scanning (e.g. ['TypeScript'])
+ * @param options - optional file, byte, and read-batch budgets
  */
-export async function scanCrashRisks(projectPath, stackHint) {
+export async function scanCrashRisks(projectPath, stackHint, options = {}) {
     const startTime = Date.now();
-    const { files, detectedStack } = await collectFiles(projectPath, stackHint);
-    const allRisks = await scanFiles(files, detectedStack);
+    const { files, detectedStack, coverage } = await collectFiles(projectPath, stackHint, options);
+    const scan = await scanFiles(projectPath, files, detectedStack, normalizeBatchSize(options.readBatchSize));
+    const allRisks = scan.risks.sort(compareRisks);
     const score = calculateScore(allRisks);
     const scanDurationMs = Date.now() - startTime;
     return {
         score,
         risks: allRisks,
-        scannedFiles: files.length,
+        scannedFiles: scan.scannedFiles,
         detectedStack,
         scanDurationMs,
+        coverage: {
+            ...coverage,
+            complete: coverage.complete && scan.unreadableFiles === 0,
+            scannedFiles: scan.scannedFiles,
+            unreadableFiles: scan.unreadableFiles,
+        },
     };
 }
-async function scanFiles(files, detectedStack) {
+function compareRisks(left, right) {
+    return (left.file.localeCompare(right.file) ||
+        left.line - right.line ||
+        left.pattern.localeCompare(right.pattern) ||
+        left.severity.localeCompare(right.severity));
+}
+async function scanFiles(projectPath, files, detectedStack, batchSize) {
     const applicableDetectors = selectDetectors(detectedStack);
-    const fileContents = fastReadFiles(files);
-    const seen = new Set(fileContents.map((file) => file.path));
-    const results = fileContents.map(({ path, content }) => detectRisksInContent(path, content, applicableDetectors));
-    const unreadByBridge = files.filter((file) => !seen.has(file));
-    const fallbackResults = await Promise.all(unreadByBridge.map(async (file) => {
-        try {
-            const content = await readFile(file, 'utf-8');
-            return detectRisksInContent(file, content, applicableDetectors);
+    const risks = [];
+    let scannedFiles = 0;
+    let unreadableFiles = 0;
+    for (let offset = 0; offset < files.length; offset += batchSize) {
+        const batch = files.slice(offset, offset + batchSize);
+        const absoluteToRelative = new Map(batch.map((file) => [join(projectPath, file), file]));
+        const fileContents = fastReadFiles([...absoluteToRelative.keys()]);
+        const seen = new Set(fileContents.map((file) => file.path));
+        for (const { path, content } of fileContents) {
+            risks.push(...detectRisksInContent(absoluteToRelative.get(path) ?? path, content, applicableDetectors));
+            scannedFiles += 1;
         }
-        catch {
-            return [];
+        const fallbackResults = await Promise.all(batch
+            .filter((file) => !seen.has(join(projectPath, file)))
+            .map(async (file) => {
+            try {
+                const content = await readFile(join(projectPath, file), 'utf-8');
+                return detectRisksInContent(file, content, applicableDetectors);
+            }
+            catch {
+                return null;
+            }
+        }));
+        for (const result of fallbackResults) {
+            if (result === null) {
+                unreadableFiles += 1;
+            }
+            else {
+                risks.push(...result);
+                scannedFiles += 1;
+            }
         }
-    }));
-    return [...results, ...fallbackResults].flat();
+    }
+    return { risks, scannedFiles, unreadableFiles };
+}
+function normalizeBatchSize(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0
+        ? Math.floor(value)
+        : DEFAULT_READ_BATCH_SIZE;
 }
 function detectRisksInContent(path, content, applicableDetectors) {
     const fileDetectors = applicableDetectors.filter((d) => d.fileExtensions.some((ext) => path.endsWith(ext)));

package/dist/engine/diff-spec-generator.js

@@ -1,5 +1,6 @@
 // engine/diff-spec-generator.ts — Diff-to-Spec generator (SPEC-350)
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
+import { assertPositivePrNumber, assertSafeGitDiffRange } from './git-safe-input.js';
 // ---------------------------------------------------------------------------
 // Diff analysis
 // ---------------------------------------------------------------------------
@@ -88,9 +89,12 @@ export function generateSpecDraft(analysis, sourceType, sourceRef, titleOverride
 // ---------------------------------------------------------------------------
 export function runGitDiff(repoPath, commitRange) {
     const range = commitRange ?? 'HEAD~1..HEAD';
-    const cmd = `git -C "${repoPath}" diff ${range}`;
+    assertSafeGitDiffRange(range);
     try {
-        return execSync(cmd, { encoding: 'utf-8', timeout: 15_000 });
+        return execFileSync('git', ['-C', repoPath, 'diff', range], {
+            encoding: 'utf-8',
+            timeout: 15_000,
+        });
     }
     catch (err) {
         throw new Error(`Failed to run git diff: ${err instanceof Error ? err.message : String(err)}. ` +
@@ -98,9 +102,12 @@ export function runGitDiff(repoPath, commitRange) {
     }
 }
 export function runGhPrDiff(repoPath, prNumber) {
-    const cmd = `gh pr diff ${prNumber} --repo "${repoPath}"`;
+    assertPositivePrNumber(prNumber);
     try {
-        return execSync(cmd, { encoding: 'utf-8', timeout: 20_000 });
+        return execFileSync('gh', ['pr', 'diff', String(prNumber), '--repo', repoPath], {
+            encoding: 'utf-8',
+            timeout: 20_000,
+        });
     }
     catch (err) {
         throw new Error(`Failed to run gh pr diff: ${err instanceof Error ? err.message : String(err)}. ` +

package/dist/engine/dogfooding/runtime-gap-detector.d.ts

@@ -0,0 +1,3 @@
+import type { DogfoodReport } from '../../types/dogfooding.js';
+export declare function analyzeRuntimeDogfooding(projectPath: string): Promise<DogfoodReport>;
+//# sourceMappingURL=runtime-gap-detector.d.ts.map