@planu/cli 4.11.9 → 4.12.2

package/dist/tools/update-status-convention-gate.js

@@ -1,16 +1,16 @@
 // tools/update-status-convention-gate.ts — SPEC-190
 // Convention and constitution compliance gates for update_status transitions.
 import { execFile as execFileCb } from 'node:child_process';
-import { createHash } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { promisify } from 'node:util';
 import { knowledgeStore } from '../storage/index.js';
 import { checkConstitutionOnTransition } from './update-status-actions.js';
+import { computeValidationEvidenceIdentity, computeValidationEvidenceKey, readMatchingValidationEvidence, recordSuccessfulValidationEvidence, recordValidationOutcome, } from '../engine/validation-evidence-ledger.js';
+import { getToolExecutionSignal } from './safe-handler.js';
+import { VALIDATION_COMMANDS } from '../engine/validation-impact-planner.js';
 const execFile = promisify(execFileCb);
-const MAX_PROCESS_VALIDATION_AGE_MS = 30 * 60 * 1_000;
 const MAX_GATE_OUTPUT_BUFFER_BYTES = 64 * 1024 * 1024;
-const processValidationReceipts = new Map();
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -26,6 +26,7 @@ async function execGate(cmd, cwd, timeoutMs) {
             cwd,
             timeout: timeoutMs,
             maxBuffer: MAX_GATE_OUTPUT_BUFFER_BYTES,
+            signal: getToolExecutionSignal(),
         });
         return { output: mergeCommandOutput(stdout, stderr), ok: true, timedOut: false };
     }
@@ -67,64 +68,164 @@ function countLintIssues(output) {
 // ---------------------------------------------------------------------------
 // Individual gates
 // ---------------------------------------------------------------------------
-async function checkCompileGate(projectPath, lintCommand) {
-    // Prefer tsc --noEmit; fall back to checking if lint command already covers it
-    const hasTsc = lintCommand?.includes('tsc') ?? false;
-    if (hasTsc) {
-        return []; // lint will cover compile
+async function checkCompileGate(projectPath, projectId) {
+    const input = {
+        projectPath,
+        capability: 'typecheck',
+        command: VALIDATION_COMMANDS.typecheck,
+        scope: ['src', 'tests'],
+    };
+    if (readMatchingValidationEvidence(projectId, input)) {
+        return [];
     }
-    const { output, ok } = await execGate('npx tsc --noEmit', projectPath, 15_000);
+    const expectedKey = computeValidationEvidenceKey(computeValidationEvidenceIdentity(input));
+    const { output, ok, timedOut, errorMessage } = await execGate(VALIDATION_COMMANDS.typecheck, projectPath, 120_000);
     if (ok) {
+        recordSuccessfulValidationEvidence({
+            projectId,
+            input,
+            expectedKey,
+            producer: 'update-status-compliance',
+            durationMs: 0,
+            output,
+            reason: 'Typecheck passed during compliance validation.',
+        });
         return [];
     }
+    recordValidationOutcome({
+        projectId,
+        input,
+        action: timedOut || getToolExecutionSignal()?.aborted === true ? 'aborted' : 'executed',
+        producer: 'update-status-compliance',
+        status: timedOut || getToolExecutionSignal()?.aborted === true ? 'cancelled' : 'failed',
+        durationMs: 0,
+        output,
+        reason: 'Typecheck did not pass during compliance validation.',
+        source: 'local:update-status',
+    });
     const lines = output.split('\n').filter((l) => l.includes('error TS'));
     if (lines.length === 0) {
-        return [];
+        const reason = timedOut ? 'timed out or was aborted' : (errorMessage ?? 'command failed');
+        return [`TypeScript compile: ${reason}. Command: ${VALIDATION_COMMANDS.typecheck}`];
     }
     const preview = lines.slice(0, 3).join('; ');
     return [`TypeScript compile: ${lines.length} error(s). ${preview}`];
 }
-async function checkLintGate(projectPath, lintCmd) {
+async function checkLintGate(projectPath, lintCmd, projectId) {
+    const cmd = lintCmd ?? VALIDATION_COMMANDS.lint;
+    const input = { projectPath, capability: 'lint', command: cmd, scope: ['src', 'tests'] };
     if (lintCmd !== null && !isSafeCommand(lintCmd)) {
-        console.warn(`[Planu] convention-gate: lintCommand contains unsafe characters — skipping`);
+        console.warn('[Planu] convention-gate: lintCommand contains unsafe characters — skipping');
+        recordValidationOutcome({
+            projectId,
+            input,
+            action: 'skipped',
+            producer: 'update-status-compliance',
+            status: 'failed',
+            durationMs: 0,
+            output: 'Unsafe configured lint command was blocked.',
+            reason: 'Configured lint command failed the command allowlist.',
+            source: 'local:update-status',
+        });
+        return ['Lint: unsafe configured command was blocked. Fix the project lintCommand.'];
+    }
+    if (readMatchingValidationEvidence(projectId, input)) {
         return [];
     }
-    const cmd = lintCmd ?? 'npx eslint src --max-warnings=0 --format=compact';
-    const { output, ok } = await execGate(cmd, projectPath, 10_000);
+    const expectedKey = computeValidationEvidenceKey(computeValidationEvidenceIdentity(input));
+    const { output, ok, timedOut } = await execGate(cmd, projectPath, 10_000);
     if (ok) {
+        recordSuccessfulValidationEvidence({
+            projectId,
+            input,
+            expectedKey,
+            producer: 'update-status-compliance',
+            durationMs: 0,
+            output,
+            reason: 'Lint passed during compliance validation.',
+        });
         return [];
     }
+    recordValidationOutcome({
+        projectId,
+        input,
+        action: timedOut || getToolExecutionSignal()?.aborted === true ? 'aborted' : 'executed',
+        producer: 'update-status-compliance',
+        status: timedOut || getToolExecutionSignal()?.aborted === true ? 'cancelled' : 'failed',
+        durationMs: 0,
+        output,
+        reason: 'Lint did not pass during compliance validation.',
+        source: 'local:update-status',
+    });
     const issueCount = countLintIssues(output);
     if (issueCount === 0) {
-        return [];
+        return [`Lint: command failed without diagnostics. Command: ${cmd}`];
     }
     const preview = output.split('\n').find((l) => l.trim().length > 0) ?? '';
     return [`Lint: ${issueCount} issue(s). ${preview}`];
 }
-async function checkTestGate(projectPath, testCmd, _context) {
+async function checkTestGate(projectPath, testCmd, context) {
     if (testCmd !== null && !isSafeCommand(testCmd)) {
-        console.warn(`[Planu] convention-gate: testCommand contains unsafe characters — skipping`);
-        return [];
+        console.warn('[Planu] convention-gate: testCommand contains unsafe characters — skipping');
+        recordValidationOutcome({
+            projectId: context.projectId,
+            input: {
+                projectPath,
+                capability: 'test-full',
+                command: testCmd,
+                scope: ['src', 'tests'],
+            },
+            action: 'skipped',
+            producer: 'update-status-compliance',
+            status: 'failed',
+            durationMs: 0,
+            output: 'Unsafe configured test command was blocked.',
+            reason: 'Configured test command failed the command allowlist.',
+            source: 'local:update-status',
+        });
+        return ['Tests: unsafe configured command was blocked. Fix the project testCommand.'];
     }
     const cmd = testCmd ?? (await resolveCanonicalTestCommand(projectPath));
-    const fingerprintBefore = await readRepositoryFingerprint(projectPath);
-    if (fingerprintBefore && hasFreshProcessValidation(projectPath, cmd, fingerprintBefore)) {
+    const input = {
+        projectPath,
+        capability: 'test-full',
+        command: cmd,
+        scope: ['src', 'tests'],
+    };
+    const expectedKey = computeValidationEvidenceKey(computeValidationEvidenceIdentity(input));
+    if (readMatchingValidationEvidence(context.projectId, input)) {
         return [];
     }
     // Run tests with a reasonable timeout — only a warning if they fail
     const timeoutMs = 120_000;
     const { output, ok, timedOut, errorMessage, errorCode } = await execGate(cmd, projectPath, timeoutMs);
     if (ok) {
-        const fingerprintAfter = await readRepositoryFingerprint(projectPath);
-        if (fingerprintBefore && fingerprintAfter === fingerprintBefore) {
-            processValidationReceipts.set(projectPath, {
-                command: cmd,
-                repositoryFingerprint: fingerprintAfter,
-                completedAtMs: Date.now(),
-            });
-        }
+        recordSuccessfulValidationEvidence({
+            projectId: context.projectId,
+            input,
+            expectedKey,
+            producer: 'update-status-compliance',
+            durationMs: 0,
+            output,
+            reason: context.specId
+                ? `Full tests passed while closing ${context.specId}.`
+                : 'Full tests passed during compliance validation.',
+        });
         return [];
     }
+    recordValidationOutcome({
+        projectId: context.projectId,
+        input,
+        action: timedOut || getToolExecutionSignal()?.aborted === true ? 'aborted' : 'executed',
+        producer: 'update-status-compliance',
+        status: timedOut || getToolExecutionSignal()?.aborted === true ? 'cancelled' : 'failed',
+        durationMs: 0,
+        output,
+        reason: context.specId
+            ? `Tests did not pass while closing ${context.specId}.`
+            : 'Tests did not pass during compliance validation.',
+        source: 'local:update-status',
+    });
     if (timedOut) {
         return [`Tests: timed out after ${String(timeoutMs)}ms. Command: ${cmd}`];
     }
@@ -146,70 +247,6 @@ async function checkTestGate(projectPath, testCmd, _context) {
         'No failure summary available.';
     return [`Tests: failed. ${summary.trim()}`];
 }
-function hasFreshProcessValidation(projectPath, command, repositoryFingerprint) {
-    const receipt = processValidationReceipts.get(projectPath);
-    if (!receipt) {
-        return false;
-    }
-    const ageMs = Date.now() - receipt.completedAtMs;
-    return (receipt.command === command &&
-        receipt.repositoryFingerprint === repositoryFingerprint &&
-        ageMs >= 0 &&
-        ageMs <= MAX_PROCESS_VALIDATION_AGE_MS);
-}
-async function readGitOutput(projectPath, args) {
-    return new Promise((resolveOutput) => {
-        execFileCb('git', args, { cwd: projectPath, timeout: 5_000, maxBuffer: MAX_GATE_OUTPUT_BUFFER_BYTES }, (error, stdout) => {
-            if (error) {
-                resolveOutput(null);
-                return;
-            }
-            const output = Buffer.isBuffer(stdout) ? stdout.toString('utf-8') : stdout;
-            resolveOutput(output);
-        });
-    });
-}
-async function readRepositoryFingerprint(projectPath) {
-    const [headOutput, statusOutput, indexDiff, worktreeDiff, untrackedOutput] = await Promise.all([
-        readGitOutput(projectPath, ['rev-parse', 'HEAD']),
-        readGitOutput(projectPath, ['status', '--porcelain=v1', '-z', '--untracked-files=all']),
-        readGitOutput(projectPath, ['diff', '--cached', '--binary', '--no-ext-diff', 'HEAD', '--']),
-        readGitOutput(projectPath, ['diff', '--binary', '--no-ext-diff', '--']),
-        readGitOutput(projectPath, ['ls-files', '--others', '--exclude-standard', '-z']),
-    ]);
-    const head = headOutput
-        ?.split('\n')
-        .map((line) => line.trim())
-        .find((line) => /^[a-f0-9]{40,64}$/i.test(line));
-    if (!head ||
-        statusOutput === null ||
-        indexDiff === null ||
-        worktreeDiff === null ||
-        untrackedOutput === null) {
-        return null;
-    }
-    const untrackedPaths = untrackedOutput.split('\0').filter(Boolean).sort();
-    const untrackedHashes = await Promise.all(untrackedPaths.map((path) => readGitOutput(projectPath, ['hash-object', '--no-filters', '--', path])));
-    if (untrackedHashes.some((hash) => hash === null)) {
-        return null;
-    }
-    const hash = createHash('sha256')
-        .update(head)
-        .update('\0')
-        .update(statusOutput)
-        .update('\0')
-        .update(indexDiff)
-        .update('\0')
-        .update(worktreeDiff);
-    for (let index = 0; index < untrackedPaths.length; index += 1) {
-        hash
-            .update('\0')
-            .update(untrackedPaths[index] ?? '')
-            .update('\0')
-            .update(untrackedHashes[index] ?? '');
-    }
-    return hash.digest('hex');
-}
 async function resolveCanonicalTestCommand(projectPath) {
     try {
         const raw = await readFile(join(projectPath, 'package.json'), 'utf-8');
@@ -238,7 +275,7 @@ async function resolveCanonicalTestCommand(projectPath) {
 }
 /** Test-only reset to prevent process-cache state leaking between cases. */
 export function resetProcessValidationCacheForTests() {
-    processValidationReceipts.clear();
+    // Compatibility hook retained for callers; canonical receipts are immutable on disk.
 }
 function isInfrastructureError(errorCode, errorMessage) {
     return (errorCode === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER' ||
@@ -273,11 +310,9 @@ export async function runComplianceGates(projectId, specTitle, specTags, newStat
         isApprovedOrDone
             ? checkConstitutionOnTransition(projectId, specTitle, specTags)
             : Promise.resolve([]),
+        isDone && projectPath ? checkCompileGate(projectPath, projectId) : Promise.resolve([]),
         isDone && projectPath
-            ? checkCompileGate(projectPath, knowledge?.lintCommand ?? null)
-            : Promise.resolve([]),
-        isDone && projectPath
-            ? checkLintGate(projectPath, knowledge?.lintCommand ?? null)
+            ? checkLintGate(projectPath, knowledge?.lintCommand ?? null, projectId)
             : Promise.resolve([]),
         isDone && projectPath
             ? checkTestGate(projectPath, knowledge?.testCommand ?? null, { projectId, specId })

package/dist/tools/validate-lint.d.ts

@@ -3,6 +3,6 @@ interface LintCheckContext {
     projectId?: string;
     specId?: string;
 }
-export declare function runLintCheck(projectPath: string, lintCommand: string | null, context?: LintCheckContext): LintCheckResult;
+export declare function runLintCheck(projectPath: string, lintCommand: string | null, context?: LintCheckContext): Promise<LintCheckResult>;
 export {};
 //# sourceMappingURL=validate-lint.d.ts.map

package/dist/tools/validate-lint.js

@@ -1,14 +1,11 @@
 // tools/validate-lint.ts — Lint gate for validate.
-import { execFileSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { projectDataDir } from '../storage/base-store.js';
-import { formatLintFailureDiagnostics, resolveProjectCommandPlan, runProjectCommandPlan, } from './validate-runtime.js';
+import { computeValidationEvidenceIdentity, computeValidationEvidenceKey, readMatchingValidationEvidence, recordSuccessfulValidationEvidence, recordValidationOutcome, } from '../engine/validation-evidence-ledger.js';
+import { formatLintFailureDiagnostics, resolveProjectCommandPlan, runProjectCommandPlan, } from '../engine/project-command-runtime.js';
+import { getToolExecutionSignal } from './safe-handler.js';
+import { VALIDATION_COMMANDS } from '../engine/validation-impact-planner.js';
 /** Allowlist: alphanumerics, spaces, and safe shell chars. Rejects ; | $ ` & < > */
 const SAFE_COMMAND_RE = /^[\w\s./:@~=-]+$/;
 const DEFAULT_LINT_CHECK_TIMEOUT_MS = 60_000;
-const LINT_CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 function isSafeCommand(cmd) {
     return SAFE_COMMAND_RE.test(cmd);
 }
@@ -40,31 +37,74 @@ function parseLintIssueCount(output) {
     }
     return output.split('\n').filter((l) => l.trim().length > 0).length;
 }
-export function runLintCheck(projectPath, lintCommand, context = {}) {
+export async function runLintCheck(projectPath, lintCommand, context = {}) {
+    const command = lintCommand ?? VALIDATION_COMMANDS.lint;
+    const evidenceInput = {
+        projectPath,
+        capability: 'lint',
+        command,
+        scope: ['src', 'tests'],
+    };
     if (lintCommand !== null && !isSafeCommand(lintCommand)) {
         console.warn(`[Planu] validate: lintCommand contains unsafe characters — skipping execution`);
+        if (context.projectId) {
+            recordValidationOutcome({
+                projectId: context.projectId,
+                input: evidenceInput,
+                action: 'skipped',
+                producer: 'planu-validate',
+                status: 'failed',
+                durationMs: 0,
+                output: 'Unsafe configured lint command was blocked.',
+                reason: 'Configured lint command failed the command allowlist.',
+                source: 'local:planu-validate',
+            });
+        }
         return {
-            passed: true,
+            passed: false,
             command: lintCommand,
-            issueCount: 0,
-            output: '(skipped — unsafe command)',
+            issueCount: 1,
+            output: '(blocked — unsafe lint command configuration)',
         };
     }
-    const command = lintCommand ?? 'pnpm lint';
-    const externalEvidence = readExternalPassedLintEvidence(context, command);
-    if (externalEvidence !== null) {
-        return externalEvidence;
-    }
     const plan = resolveProjectCommandPlan(projectPath, command);
-    const fingerprint = calculateLintFingerprint(projectPath);
-    const cached = readPassedLintCache(projectPath, command, fingerprint);
-    if (cached !== null) {
-        return cached;
+    const expectedKey = computeValidationEvidenceKey(computeValidationEvidenceIdentity(evidenceInput));
+    if (context.projectId) {
+        const receipt = readMatchingValidationEvidence(context.projectId, evidenceInput);
+        if (receipt) {
+            return {
+                passed: true,
+                command,
+                issueCount: 0,
+                output: `(reused canonical validation receipt ${receipt.key})`,
+            };
+        }
     }
     const timeoutMs = lintCheckTimeoutMs();
     try {
-        runProjectCommandPlan(plan, projectPath, timeoutMs);
-        writePassedLintCache(projectPath, command, fingerprint);
+        const startedAt = Date.now();
+        const processResult = await runProjectCommandPlan(plan, projectPath, timeoutMs, getToolExecutionSignal());
+        if (processResult.error || processResult.status !== 0) {
+            throw Object.assign(processResult.error ?? new Error('Lint command failed'), {
+                stdout: processResult.stdout,
+                stderr: processResult.stderr,
+                killed: processResult.timedOut || processResult.aborted,
+                signal: processResult.signal,
+            });
+        }
+        if (context.projectId) {
+            recordSuccessfulValidationEvidence({
+                projectId: context.projectId,
+                input: evidenceInput,
+                expectedKey,
+                producer: 'planu-validate',
+                durationMs: Date.now() - startedAt,
+                output: processResult.stdout,
+                reason: context.specId
+                    ? `Lint passed while validating ${context.specId}.`
+                    : 'Lint passed during canonical validation.',
+            });
+        }
         return { passed: true, command, issueCount: 0, output: '' };
     }
     catch (err) {
@@ -77,43 +117,25 @@ export function runLintCheck(projectPath, lintCommand, context = {}) {
         }
         const raw = commandOutput(err);
         const output = formatLintFailureDiagnostics(plan, raw);
-        const issueCount = parseLintIssueCount(raw.trim());
+        const issueCount = Math.max(1, parseLintIssueCount(raw.trim()));
         console.warn(`[Planu] lintCheck failed: command="${plan.executedCommand}" cwd="${projectPath}" issues=${String(issueCount)}`);
-        return { passed: false, command, issueCount, output };
-    }
-}
-function readExternalPassedLintEvidence(context, command) {
-    if (!context.projectId || !context.specId) {
-        return null;
-    }
-    try {
-        const path = join(projectDataDir(context.projectId), 'handoffs', context.specId, 'traceability-matrix.json');
-        if (!existsSync(path)) {
-            return null;
-        }
-        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
-        const rows = Array.isArray(parsed.rows) ? parsed.rows : [];
-        if (rows.length === 0 ||
-            !rows.every((row) => isPassedFullValidationEvidence(row.validationEvidence))) {
-            return null;
+        if (context.projectId) {
+            recordValidationOutcome({
+                projectId: context.projectId,
+                input: evidenceInput,
+                action: isCommandTimeout(err) ? 'aborted' : 'executed',
+                producer: 'planu-validate',
+                status: isCommandTimeout(err) ? 'cancelled' : 'failed',
+                durationMs: timeoutMs,
+                output,
+                reason: context.specId
+                    ? `Lint did not pass while validating ${context.specId}.`
+                    : 'Lint did not pass during canonical validation.',
+                source: 'local:planu-validate',
+            });
         }
-        return {
-            passed: true,
-            command,
-            issueCount: 0,
-            output: `(reused external validation evidence from handoffs/${context.specId}/traceability-matrix.json)`,
-        };
-    }
-    catch {
-        return null;
-    }
-}
-function isPassedFullValidationEvidence(value) {
-    if (typeof value !== 'string') {
-        return false;
+        return { passed: false, command, issueCount, output };
     }
-    return (/\bpnpm\s+validate\b[\s\S]{0,160}\bpass(?:ed|ing)?\b/i.test(value) ||
-        /\bpass(?:ed|ing)?\b[\s\S]{0,160}\bpnpm\s+validate\b/i.test(value));
 }
 function lintCheckTimeoutMs() {
     const raw = process.env.PLANU_VALIDATE_LINT_TIMEOUT_MS;
@@ -126,113 +148,4 @@ function lintCheckTimeoutMs() {
     }
     return Math.min(300_000, Math.max(1_000, parsed));
 }
-function lintCachePath(projectPath) {
-    return join(projectPath, 'planu', 'state', 'lint-evidence.json');
-}
-function readPassedLintCache(projectPath, command, fingerprint) {
-    try {
-        const path = lintCachePath(projectPath);
-        if (!existsSync(path)) {
-            return null;
-        }
-        const cache = JSON.parse(readFileSync(path, 'utf-8'));
-        if (cache.schemaVersion !== '1.0.0' ||
-            cache.command !== command ||
-            cache.fingerprint !== fingerprint ||
-            typeof cache.checkedAt !== 'string') {
-            return null;
-        }
-        const ageMs = Date.now() - Date.parse(cache.checkedAt);
-        if (!Number.isFinite(ageMs) || ageMs < 0 || ageMs > LINT_CACHE_MAX_AGE_MS) {
-            return null;
-        }
-        return {
-            passed: true,
-            command,
-            issueCount: 0,
-            output: `(reused local lint evidence from ${cache.checkedAt})`,
-        };
-    }
-    catch {
-        return null;
-    }
-}
-function writePassedLintCache(projectPath, command, fingerprint) {
-    try {
-        const path = lintCachePath(projectPath);
-        mkdirSync(dirname(path), { recursive: true });
-        const cache = {
-            schemaVersion: '1.0.0',
-            command,
-            fingerprint,
-            checkedAt: new Date().toISOString(),
-        };
-        writeFileSync(path, `${JSON.stringify(cache, null, 2)}\n`, 'utf-8');
-    }
-    catch {
-        // Cache is a performance optimization only; lint result remains authoritative.
-    }
-}
-function calculateLintFingerprint(projectPath) {
-    const hash = createHash('sha256');
-    hash.update(gitOutput(projectPath, ['rev-parse', 'HEAD']));
-    hash.update('\0');
-    hash.update(gitOutput(projectPath, [
-        'diff',
-        '--binary',
-        'HEAD',
-        '--',
-        'src',
-        'tests',
-        'package.json',
-        'pnpm-lock.yaml',
-        'eslint.config.js',
-        'eslint.config.mjs',
-        'eslint.config.cjs',
-        'tsconfig.json',
-        'tsconfig.build.json',
-    ]));
-    hash.update('\0');
-    const untracked = gitOutput(projectPath, [
-        'ls-files',
-        '--others',
-        '--exclude-standard',
-        '--',
-        'src',
-        'tests',
-    ])
-        .split('\n')
-        .map((line) => line.trim())
-        .filter(Boolean)
-        .sort();
-    for (const file of untracked) {
-        hash.update(file);
-        hash.update('\0');
-        try {
-            hash.update(readFileSync(join(projectPath, file)));
-        }
-        catch {
-            hash.update('unreadable');
-        }
-        hash.update('\0');
-    }
-    return hash.digest('hex');
-}
-function gitOutput(projectPath, args) {
-    try {
-        const output = execFileSync('git', args, {
-            cwd: projectPath,
-            encoding: 'utf-8',
-            timeout: 5_000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        if (Buffer.isBuffer(output)) {
-            return output.toString('utf-8');
-        }
-        return typeof output === 'string' ? output : String(output);
-    }
-    catch {
-        return '';
-    }
-}
 //# sourceMappingURL=validate-lint.js.map

package/dist/tools/validate.js

@@ -21,6 +21,7 @@ import { buildValidateFailureFallback, validateStrictLayoutOrError } from './val
 import { runLintCheck } from './validate-lint.js';
 import { checkPlanuUncommittedChanges, runAssuranceGates } from './validate-assurance.js';
 import { applyValidateStructuredCompat } from './validate-structured-compat.js';
+import { getToolExecutionSignal } from './safe-handler.js';
 // Re-export for external use (SPEC-018)
 export { validateContractCompliance };
 // SPEC-595: server? param enables elicitation on failures
@@ -74,7 +75,7 @@ export async function handleValidate(args, server) {
     const implementationQualityScore = calcQualityScore(result.qualityIssues);
     const auditedFiles = [...new Set(result.qualityIssues.map((i) => i.file))];
     const { conventionViolations, regressionDetected } = await scanProjectConventions(projectId, projectPath);
-    const lintCheck = runLintCheck(projectPath, knowledge.lintCommand ?? null, {
+    const lintCheck = await runLintCheck(projectPath, knowledge.lintCommand ?? null, {
         projectId,
         specId,
     });
@@ -98,6 +99,7 @@ export async function handleValidate(args, server) {
         lintPassed: lintCheck.passed,
         conventionRegression: regressionDetected,
         minimalityReport: minimalityReport ?? undefined,
+        signal: getToolExecutionSignal(),
     });
     const effectiveResult = buildEffectiveValidationResult(result, validationReport.specCompliance);
     const qualityGateSummary = buildQualityGateSummary({