@planu/cli 4.11.6 → 4.11.8

package/dist/tools/update-status-convention-gate.js

@@ -1,10 +1,16 @@
 // tools/update-status-convention-gate.ts — SPEC-190
 // Convention and constitution compliance gates for update_status transitions.
 import { execFile as execFileCb } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
 import { promisify } from 'node:util';
 import { knowledgeStore } from '../storage/index.js';
 import { checkConstitutionOnTransition } from './update-status-actions.js';
 const execFile = promisify(execFileCb);
+const MAX_PROCESS_VALIDATION_AGE_MS = 30 * 60 * 1_000;
+const MAX_GATE_OUTPUT_BUFFER_BYTES = 64 * 1024 * 1024;
+const processValidationReceipts = new Map();
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -19,7 +25,7 @@ async function execGate(cmd, cwd, timeoutMs) {
         const { stdout, stderr } = await execFile(bin ?? 'sh', args, {
             cwd,
             timeout: timeoutMs,
-            maxBuffer: 4 * 1024 * 1024,
+            maxBuffer: MAX_GATE_OUTPUT_BUFFER_BYTES,
         });
         return { output: mergeCommandOutput(stdout, stderr), ok: true, timedOut: false };
     }
@@ -27,7 +33,13 @@ async function execGate(cmd, cwd, timeoutMs) {
         const e = err;
         const raw = mergeCommandOutput(e.stdout, e.stderr);
         const timedOut = e.killed === true || e.signal === 'SIGTERM' || e.code === 'ETIMEDOUT';
-        return { output: raw.trim(), ok: false, timedOut, errorMessage: e.message };
+        return {
+            output: raw.trim(),
+            ok: false,
+            timedOut,
+            errorMessage: e.message,
+            errorCode: typeof e.code === 'string' ? e.code : undefined,
+        };
     }
 }
 function mergeCommandOutput(stdout, stderr) {
@@ -89,21 +101,37 @@ async function checkLintGate(projectPath, lintCmd) {
     const preview = output.split('\n').find((l) => l.trim().length > 0) ?? '';
     return [`Lint: ${issueCount} issue(s). ${preview}`];
 }
-async function checkTestGate(projectPath, testCmd) {
+async function checkTestGate(projectPath, testCmd, _context) {
     if (testCmd !== null && !isSafeCommand(testCmd)) {
         console.warn(`[Planu] convention-gate: testCommand contains unsafe characters — skipping`);
         return [];
     }
+    const cmd = testCmd ?? (await resolveCanonicalTestCommand(projectPath));
+    const fingerprintBefore = await readRepositoryFingerprint(projectPath);
+    if (fingerprintBefore && hasFreshProcessValidation(projectPath, cmd, fingerprintBefore)) {
+        return [];
+    }
     // Run tests with a reasonable timeout — only a warning if they fail
-    const cmd = testCmd ?? 'npx vitest run --reporter=verbose';
     const timeoutMs = 120_000;
-    const { output, ok, timedOut, errorMessage } = await execGate(cmd, projectPath, timeoutMs);
+    const { output, ok, timedOut, errorMessage, errorCode } = await execGate(cmd, projectPath, timeoutMs);
     if (ok) {
+        const fingerprintAfter = await readRepositoryFingerprint(projectPath);
+        if (fingerprintBefore && fingerprintAfter === fingerprintBefore) {
+            processValidationReceipts.set(projectPath, {
+                command: cmd,
+                repositoryFingerprint: fingerprintAfter,
+                completedAtMs: Date.now(),
+            });
+        }
         return [];
     }
     if (timedOut) {
         return [`Tests: timed out after ${String(timeoutMs)}ms. Command: ${cmd}`];
     }
+    if (isInfrastructureError(errorCode, errorMessage)) {
+        const detail = errorCode ?? errorMessage ?? 'unknown child-process error';
+        return [`Tests: infrastructure failure (${detail}). Command: ${cmd}`];
+    }
     // Extract summary line (e.g. "5 failed" or "FAIL src/foo.test.ts")
     const failLine = output
         .split('\n')
@@ -118,6 +146,106 @@ async function checkTestGate(projectPath, testCmd) {
         'No failure summary available.';
     return [`Tests: failed. ${summary.trim()}`];
 }
+function hasFreshProcessValidation(projectPath, command, repositoryFingerprint) {
+    const receipt = processValidationReceipts.get(projectPath);
+    if (!receipt) {
+        return false;
+    }
+    const ageMs = Date.now() - receipt.completedAtMs;
+    return (receipt.command === command &&
+        receipt.repositoryFingerprint === repositoryFingerprint &&
+        ageMs >= 0 &&
+        ageMs <= MAX_PROCESS_VALIDATION_AGE_MS);
+}
+async function readGitOutput(projectPath, args) {
+    return new Promise((resolveOutput) => {
+        execFileCb('git', args, { cwd: projectPath, timeout: 5_000, maxBuffer: MAX_GATE_OUTPUT_BUFFER_BYTES }, (error, stdout) => {
+            if (error) {
+                resolveOutput(null);
+                return;
+            }
+            const output = Buffer.isBuffer(stdout) ? stdout.toString('utf-8') : stdout;
+            resolveOutput(output);
+        });
+    });
+}
+async function readRepositoryFingerprint(projectPath) {
+    const [headOutput, statusOutput, indexDiff, worktreeDiff, untrackedOutput] = await Promise.all([
+        readGitOutput(projectPath, ['rev-parse', 'HEAD']),
+        readGitOutput(projectPath, ['status', '--porcelain=v1', '-z', '--untracked-files=all']),
+        readGitOutput(projectPath, ['diff', '--cached', '--binary', '--no-ext-diff', 'HEAD', '--']),
+        readGitOutput(projectPath, ['diff', '--binary', '--no-ext-diff', '--']),
+        readGitOutput(projectPath, ['ls-files', '--others', '--exclude-standard', '-z']),
+    ]);
+    const head = headOutput
+        ?.split('\n')
+        .map((line) => line.trim())
+        .find((line) => /^[a-f0-9]{40,64}$/i.test(line));
+    if (!head ||
+        statusOutput === null ||
+        indexDiff === null ||
+        worktreeDiff === null ||
+        untrackedOutput === null) {
+        return null;
+    }
+    const untrackedPaths = untrackedOutput.split('\0').filter(Boolean).sort();
+    const untrackedHashes = await Promise.all(untrackedPaths.map((path) => readGitOutput(projectPath, ['hash-object', '--no-filters', '--', path])));
+    if (untrackedHashes.some((hash) => hash === null)) {
+        return null;
+    }
+    const hash = createHash('sha256')
+        .update(head)
+        .update('\0')
+        .update(statusOutput)
+        .update('\0')
+        .update(indexDiff)
+        .update('\0')
+        .update(worktreeDiff);
+    for (let index = 0; index < untrackedPaths.length; index += 1) {
+        hash
+            .update('\0')
+            .update(untrackedPaths[index] ?? '')
+            .update('\0')
+            .update(untrackedHashes[index] ?? '');
+    }
+    return hash.digest('hex');
+}
+async function resolveCanonicalTestCommand(projectPath) {
+    try {
+        const raw = await readFile(join(projectPath, 'package.json'), 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null) {
+            return 'npx vitest run';
+        }
+        const manifest = parsed;
+        if (typeof manifest.scripts?.test !== 'string' || manifest.scripts.test.trim().length === 0) {
+            return 'npx vitest run';
+        }
+        const packageManager = typeof manifest.packageManager === 'string'
+            ? (manifest.packageManager.split('@')[0]?.trim() ?? '')
+            : '';
+        if (packageManager === 'pnpm' || packageManager === 'yarn') {
+            return `${packageManager} test`;
+        }
+        if (packageManager === 'bun') {
+            return 'bun run test';
+        }
+        return 'npm test';
+    }
+    catch {
+        return 'npx vitest run';
+    }
+}
+/** Test-only reset to prevent process-cache state leaking between cases. */
+export function resetProcessValidationCacheForTests() {
+    processValidationReceipts.clear();
+}
+function isInfrastructureError(errorCode, errorMessage) {
+    return (errorCode === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER' ||
+        errorCode === 'ENOENT' ||
+        errorCode === 'EACCES' ||
+        /maxBuffer|spawn .* (?:ENOENT|EACCES)/i.test(errorMessage ?? ''));
+}
 function isPassingSummaryLine(line) {
     return /^\s*(?:✓|PASS\b|Test Files\s+\d+\s+passed|Tests\s+\d+\s+passed)/i.test(line.trim());
 }
@@ -135,7 +263,7 @@ function isFailureSummaryLine(line) {
  * Runs non-blocking transition checks not already covered by the authoritative validate report.
  * in parallel. Extracts complexity from handleUpdateStatus.
  */
-export async function runComplianceGates(projectId, specTitle, specTags, newStatus) {
+export async function runComplianceGates(projectId, specTitle, specTags, newStatus, specId) {
     const isDone = newStatus === 'done';
     const isApprovedOrDone = newStatus === 'approved' || isDone;
     // Load knowledge once — needed for project path and commands
@@ -152,7 +280,7 @@ export async function runComplianceGates(projectId, specTitle, specTags, newStat
             ? checkLintGate(projectPath, knowledge?.lintCommand ?? null)
             : Promise.resolve([]),
         isDone && projectPath
-            ? checkTestGate(projectPath, knowledge?.testCommand ?? null)
+            ? checkTestGate(projectPath, knowledge?.testCommand ?? null, { projectId, specId })
             : Promise.resolve([]),
     ]);
     return {

package/dist/types/browser-validator.d.ts

@@ -19,6 +19,8 @@ export interface BrowserValidationResult {
     playwrightVersion: string | null;
     /** UI assertions extracted from the spec. */
     assertions: UIAssertion[];
+    /** Assertions that still require manual grounding or unsupported verification. */
+    manualAssertionCount?: number;
     /** Path where the generated test file was saved (when Playwright not available). */
     testFilePath?: string;
     /** Playwright test results when run directly. */

package/dist/types/dogfooding.d.ts

@@ -0,0 +1,34 @@
+export type DogfoodSeverity = 'low' | 'medium' | 'high';
+export type DogfoodNextAction = 'create_spec' | 'submit_feedback' | 'ignore';
+export type DogfoodReportStatus = 'findings' | 'no_actionable_gaps' | 'insufficient_evidence';
+export type DogfoodArtifactLabel = 'package.json' | 'session-context' | 'session';
+export interface DogfoodLoadedArtifact {
+    label: DogfoodArtifactLabel;
+    content: string;
+    json: unknown;
+}
+export interface DogfoodSignalRule {
+    signature: string;
+    title: string;
+    severity: DogfoodSeverity;
+    nextAction: DogfoodNextAction;
+    patterns: RegExp[];
+    structuredBooleanKey?: 'forceStatus' | 'forceApprove';
+}
+export interface DogfoodFinding {
+    signature: string;
+    title: string;
+    severity: DogfoodSeverity;
+    nextAction: DogfoodNextAction;
+    occurrences: number;
+    evidence: string[];
+}
+export interface DogfoodReport {
+    status: DogfoodReportStatus;
+    findings: DogfoodFinding[];
+    /** Privacy-safe allowlist labels, never absolute paths. */
+    analyzedSources: string[];
+    /** Sources skipped because they were missing, malformed, unsafe, oversized, or unreadable. */
+    unavailableSources: string[];
+}
+//# sourceMappingURL=dogfooding.d.ts.map

package/dist/types/dogfooding.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dogfooding.js.map

package/dist/types/index.d.ts

@@ -129,6 +129,7 @@ export * from './oauth.js';
 export * from './spec-elicitation.js';
 export type * from './ai-tool-rules.js';
 export type * from './feedback.js';
+export * from './dogfooding.js';
 export * from './agent-squad.js';
 export * from './conventions.js';
 export * from './telemetry.js';

package/dist/types/index.js

@@ -126,6 +126,7 @@ export * from './discovery.js';
 export * from './token-ledger.js';
 export * from './oauth.js';
 export * from './spec-elicitation.js';
+export * from './dogfooding.js';
 export * from './agent-squad.js';
 export * from './conventions.js';
 export * from './telemetry.js';

package/dist/types/spec/core.d.ts

@@ -9,7 +9,34 @@ export interface StatusHistoryEntry {
     readonly status: SpecStatus;
     /** ISO 8601 timestamp of when this status was set. */
     readonly changedAt: string;
-}
+    /** Previous status, when recorded by the canonical transition path. */
+    readonly fromStatus?: SpecStatus;
+    /** Stable receipt used to acknowledge idempotent retries. */
+    readonly transitionId?: string;
+    /** Optional work scheduled after the durable transition boundary. */
+    readonly pendingBackgroundActions?: readonly string[];
+    /** Durable execution state for optional post-commit work. */
+    readonly postCommitTasks?: readonly PostCommitTaskReceipt[];
+}
+export type PostCommitTaskStatus = 'pending' | 'running' | 'done' | 'failed';
+export interface PostCommitTaskReceipt {
+    readonly name: string;
+    readonly status: PostCommitTaskStatus;
+    readonly attempts: number;
+    readonly updatedAt: string;
+    readonly executionId?: string;
+    readonly leaseExpiresAt?: string;
+    readonly lastError?: string;
+}
+export type PostCommitTaskClaim = {
+    readonly claimed: true;
+    readonly executionId: string;
+    readonly attempts: number;
+} | {
+    readonly claimed: false;
+    readonly reason: 'done' | 'running' | 'missing';
+    readonly retryAt?: string;
+};
 export interface Spec {
     id: string;
     /** SPEC-601: Globally unique identifier for cross-project portability. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "4.11.6",
+  "version": "4.11.8",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -34,14 +34,14 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "4.11.6",
-    "@planu/core-darwin-x64": "4.11.6",
-    "@planu/core-linux-arm64-gnu": "4.11.6",
-    "@planu/core-linux-arm64-musl": "4.11.6",
-    "@planu/core-linux-x64-gnu": "4.11.6",
-    "@planu/core-linux-x64-musl": "4.11.6",
-    "@planu/core-win32-arm64-msvc": "4.11.6",
-    "@planu/core-win32-x64-msvc": "4.11.6"
+    "@planu/core-darwin-arm64": "4.11.8",
+    "@planu/core-darwin-x64": "4.11.8",
+    "@planu/core-linux-arm64-gnu": "4.11.8",
+    "@planu/core-linux-arm64-musl": "4.11.8",
+    "@planu/core-linux-x64-gnu": "4.11.8",
+    "@planu/core-linux-x64-musl": "4.11.8",
+    "@planu/core-win32-arm64-msvc": "4.11.8",
+    "@planu/core-win32-x64-msvc": "4.11.8"
   },
   "engines": {
     "node": ">=24.0.0"
@@ -99,11 +99,11 @@
   },
   "lint-staged": {
     "src/**/*.ts": [
-      "eslint --fix --max-warnings 0",
+      "eslint --fix --max-warnings 0 --no-warn-ignored",
       "prettier --write"
     ],
     "tests/**/*.test.ts": [
-      "eslint --fix --max-warnings 0",
+      "eslint --fix --max-warnings 0 --no-warn-ignored",
       "prettier --write"
     ],
     "*.json": [
@@ -133,7 +133,7 @@
   ],
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.110.0",
+    "@anthropic-ai/sdk": "^0.112.3",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "glob": "^13.0.6",
     "yaml": "^2.9.0",
@@ -143,35 +143,35 @@
     "@commitlint/cli": "^21.2.1",
     "@commitlint/config-conventional": "^21.2.0",
     "@eslint/js": "^10.0.1",
-    "@napi-rs/cli": "^3.7.2",
+    "@napi-rs/cli": "^3.7.3",
     "@secretlint/secretlint-rule-no-homedir": "^13.0.2",
     "@secretlint/secretlint-rule-preset-recommend": "^13.0.2",
     "@stryker-mutator/core": "^9.6.1",
     "@stryker-mutator/vitest-runner": "^9.6.1",
-    "@supabase/supabase-js": "^2.110.2",
+    "@supabase/supabase-js": "^2.110.7",
     "@types/node": "^26.1.1",
     "@typescript/native": "npm:typescript@^7.0.2",
-    "@vitejs/plugin-vue": "^6.0.7",
+    "@vitejs/plugin-vue": "^6.0.8",
     "@vitest/coverage-v8": "^4.1.10",
     "@vue/test-utils": "^2.4.11",
-    "eslint": "^10.6.0",
+    "eslint": "^10.7.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-import": "^2.32.0",
-    "happy-dom": "^20.10.6",
+    "happy-dom": "^20.11.0",
     "husky": "^9.1.7",
-    "javascript-obfuscator": "^5.4.5",
-    "knip": "^6.25.0",
-    "lint-staged": "^17.0.8",
+    "javascript-obfuscator": "^5.5.0",
+    "knip": "^6.27.0",
+    "lint-staged": "^17.1.0",
     "madge": "^8.0.0",
-    "prettier": "^3.9.4",
+    "prettier": "^3.9.5",
     "secretlint": "^13.0.2",
-    "tsc-alias": "^1.9.0",
+    "tsc-alias": "^1.9.1",
     "type-coverage": "^2.29.7",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "typescript-eslint": "^8.63.0",
-    "vite": "^8.1.4",
+    "typescript-eslint": "^8.64.0",
+    "vite": "^8.1.5",
     "vitest": "^4.1.10",
-    "vue": "^3.5.39"
+    "vue": "^3.5.40"
   }
 }

package/planu-native.json

@@ -1,7 +1,7 @@
 {
   "name": "dev.planu.native",
   "displayName": "Planu Native Lightweight Surface",
-  "version": "4.11.6",
+  "version": "4.11.8",
   "packageName": "@planu/cli",
   "modes": {
     "lightweight": {

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "4.11.6",
+  "version": "4.11.8",
   "icon": "assets/plugin/icon.svg",
   "command": [
     "npx",