@planu/cli 4.12.3 → 4.14.1

package/dist/engine/network-policy.js

@@ -0,0 +1,174 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createRequire, syncBuiltinESMExports } from 'node:module';
+export const NETWORK_CONSENT_VERSION = 1;
+const consentStorage = new AsyncLocalStorage();
+const moduleFetch = globalThis.fetch.bind(globalThis);
+let originalFetch = moduleFetch;
+let installed = false;
+const consentReceiptToken = Symbol('planu.network-consent');
+const require = createRequire(import.meta.url);
+const httpModule = require('node:http');
+const httpsModule = require('node:https');
+const originalHttpRequest = httpModule.request;
+const originalHttpGet = httpModule.get;
+const originalHttpsRequest = httpsModule.request;
+const originalHttpsGet = httpsModule.get;
+export class OfflineNetworkError extends Error {
+    destination;
+    code = 'PLANU_OFFLINE_NETWORK_BLOCKED';
+    constructor(destination) {
+        super(`[Planu] Network access is blocked while PLANU_OFFLINE=1: ${destination}`);
+        this.destination = destination;
+        this.name = 'OfflineNetworkError';
+    }
+}
+export class NetworkConsentRequiredError extends Error {
+    destination;
+    purpose;
+    code = 'PLANU_NETWORK_CONSENT_REQUIRED';
+    constructor(destination, purpose) {
+        super(`[Planu] Network access for ${purpose} requires explicit consent at policy version ${String(NETWORK_CONSENT_VERSION)}`);
+        this.destination = destination;
+        this.purpose = purpose;
+        this.name = 'NetworkConsentRequiredError';
+    }
+}
+function environmentConsent() {
+    const entries = (process.env.PLANU_NETWORK_CONSENT ?? '')
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    const purposes = new Set();
+    for (const entry of entries) {
+        const [purpose, rawVersion] = entry.split('@');
+        if (isNetworkPurpose(purpose) && Number(rawVersion) === NETWORK_CONSENT_VERSION) {
+            purposes.add(purpose);
+        }
+    }
+    return purposes.size > 0 ? { purposes, version: NETWORK_CONSENT_VERSION } : undefined;
+}
+function isNetworkPurpose(value) {
+    return (value === 'dependency-audit' ||
+        value === 'integration' ||
+        value === 'oauth' ||
+        value === 'registry' ||
+        value === 'telemetry' ||
+        value === 'updates');
+}
+function activeConsent() {
+    return consentStorage.getStore() ?? environmentConsent();
+}
+export function assertNetworkAllowed(destination, purpose = 'unclassified') {
+    if (process.env.PLANU_OFFLINE === '1') {
+        throw new OfflineNetworkError(destination);
+    }
+    // Legacy direct clients call this guard before creating a request. Consent is
+    // centrally enforced once the process-wide wrappers are installed; retaining
+    // the pre-install offline check keeps isolated library tests and CLI imports safe.
+    if (!installed) {
+        return;
+    }
+    const consent = activeConsent();
+    if (purpose === 'unclassified' ||
+        consent?.version !== NETWORK_CONSENT_VERSION ||
+        !consent.purposes.has(purpose)) {
+        throw new NetworkConsentRequiredError(destination, purpose);
+    }
+}
+/** Scope current-version consent to one explicit operation and its async descendants. */
+export function withNetworkConsent(purpose, operation) {
+    const inherited = activeConsent();
+    const purposes = new Set(inherited?.purposes ?? []);
+    purposes.add(purpose);
+    const receipt = {
+        purpose,
+        version: NETWORK_CONSENT_VERSION,
+        token: consentReceiptToken,
+    };
+    return consentStorage.run({ purposes, version: NETWORK_CONSENT_VERSION }, () => operation(receipt));
+}
+/** A purpose-aware fetch for code paths that obtained explicit user consent. */
+export function networkFetch(receipt, input, init) {
+    const destination = typeof input === 'string' || input instanceof URL ? input.toString() : input.url;
+    try {
+        assertReceiptAllowed(receipt, destination);
+    }
+    catch (error) {
+        return Promise.reject(error instanceof Error ? error : new Error(String(error)));
+    }
+    return originalFetch(input, init);
+}
+function assertReceiptAllowed(receipt, destination) {
+    if (receipt.token !== consentReceiptToken || receipt.version !== NETWORK_CONSENT_VERSION) {
+        throw new NetworkConsentRequiredError(destination, receipt.purpose);
+    }
+    assertNetworkAllowed(destination, receipt.purpose);
+}
+function requestDestination(protocol, args) {
+    const first = args[0];
+    if (typeof first === 'string') {
+        return first;
+    }
+    if (first instanceof URL) {
+        return first.toString();
+    }
+    const options = (first ?? {});
+    const hostname = options.hostname ?? options.host ?? 'localhost';
+    const port = options.port === undefined ? '' : `:${String(options.port)}`;
+    return `${protocol}//${hostname}${port}${options.path ?? '/'}`;
+}
+function guardedRequest(protocol, original) {
+    return (...args) => {
+        assertNetworkAllowed(requestDestination(protocol, args));
+        return original(...args);
+    };
+}
+function consentedRequest(receipt, protocol, original, args) {
+    assertReceiptAllowed(receipt, requestDestination(protocol, args));
+    return original(...args);
+}
+export function networkHttpRequest(receipt, ...args) {
+    return consentedRequest(receipt, 'http:', originalHttpRequest, args);
+}
+export function networkHttpGet(receipt, ...args) {
+    return consentedRequest(receipt, 'http:', originalHttpGet, args);
+}
+export function networkHttpsRequest(receipt, ...args) {
+    return consentedRequest(receipt, 'https:', originalHttpsRequest, args);
+}
+export function networkHttpsGet(receipt, ...args) {
+    return consentedRequest(receipt, 'https:', originalHttpsGet, args);
+}
+/** Install once; every unscoped fetch fails closed before touching the transport. */
+export function installNetworkPolicy() {
+    if (installed) {
+        return;
+    }
+    originalFetch = globalThis.fetch.bind(globalThis);
+    globalThis.fetch = (input, init) => {
+        const destination = typeof input === 'string' || input instanceof URL ? input.toString() : input.url;
+        try {
+            assertNetworkAllowed(destination);
+        }
+        catch (error) {
+            return Promise.reject(error instanceof Error ? error : new Error(String(error)));
+        }
+        return originalFetch(input, init);
+    };
+    httpModule.request = guardedRequest('http:', originalHttpRequest);
+    httpModule.get = guardedRequest('http:', originalHttpGet);
+    httpsModule.request = guardedRequest('https:', originalHttpsRequest);
+    httpsModule.get = guardedRequest('https:', originalHttpsGet);
+    syncBuiltinESMExports();
+    installed = true;
+}
+export function restoreNetworkPolicyForTests() {
+    globalThis.fetch = originalFetch === moduleFetch ? moduleFetch : originalFetch;
+    httpModule.request = originalHttpRequest;
+    httpModule.get = originalHttpGet;
+    httpsModule.request = originalHttpsRequest;
+    httpsModule.get = originalHttpsGet;
+    syncBuiltinESMExports();
+    installed = false;
+}
+//# sourceMappingURL=network-policy.js.map

package/dist/engine/next-spec-resolver/dependency-filter.js

@@ -1,3 +1,4 @@
+import { evaluateSpecDependencies } from '../dependency-evaluator.js';
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -15,28 +16,7 @@
  * @returns specs that are not blocked by any unmet or cyclic dependency
  */
 export function filterBlocked(specs, allSpecs) {
-    const statusById = new Map();
-    for (const s of allSpecs) {
-        statusById.set(s.id, s.status);
-    }
-    // Detect all specs involved in cycles via DFS
-    const cycleMembers = detectCycleMembers(allSpecs);
-    return specs.filter((spec) => {
-        // Exclude any spec that is part of a cycle (Scenario 9)
-        if (cycleMembers.has(spec.id)) {
-            return false;
-        }
-        // Normalize dependencies defensively (Scenarios 10, 11)
-        const deps = normalizeDeps(spec.dependencies);
-        // Exclude if any dep is not done
-        for (const depId of deps) {
-            const depStatus = statusById.get(depId);
-            if (depStatus !== 'done') {
-                return false;
-            }
-        }
-        return true;
-    });
+    return specs.filter((spec) => evaluateSpecDependencies(spec, allSpecs).allowed);
 }
 /**
  * SPEC-686 Scenario 9: Detect all spec IDs that are part of a dependency cycle.

package/dist/engine/nfr-profile-detector.js

@@ -1,25 +1,21 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-// Planu — NFR Profile Detector (SPEC-027)
-// Derives Non-Functional Requirement profiles from project knowledge.
-// Maps system types to realistic latency, throughput, and availability targets.
+import { technologyValue } from './technology-registry.js';
 // Stack signals that indicate low-latency API requirements
 const LOW_LATENCY_SIGNALS = [
-    'express',
-    'fastify',
+    technologyValue('technology-express-008231'),
+    technologyValue('technology-fastify-cbe57e'),
     'hono',
-    'graphql',
+    technologyValue('technology-graphql-aed31c'),
     'grpc',
     'rest',
     'api',
     'gateway',
-    'redis',
+    technologyValue('technology-redis-34fb46'),
     'realtime',
     'websocket',
 ];
 // Stack signals that indicate batch processing systems
 const BATCH_SIGNALS = [
-    'celery',
+    technologyValue('technology-celery-ddc517'),
     'bull',
     'bullmq',
     'sidekiq',
@@ -38,13 +34,13 @@ const BATCH_SIGNALS = [
 ];
 // Stack signals that indicate interactive apps
 const INTERACTIVE_SIGNALS = [
-    'react',
-    'vue',
-    'angular',
-    'svelte',
+    technologyValue('technology-react-275976'),
+    technologyValue('technology-vue-564382'),
+    technologyValue('technology-angular-a39f89'),
+    technologyValue('technology-svelte-c190ac'),
     'next',
-    'nuxt',
-    'remix',
+    technologyValue('technology-nuxt-22c407'),
+    technologyValue('technology-remix-0c5d96'),
     'spa',
     'frontend',
     'ui',

package/dist/engine/nli-keywords.js

@@ -1,5 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
+import { technologyValue } from './technology-registry.js';
 // engine/nli-keywords.ts — NLI intent keyword maps and entity synonyms
 // Data-only module: no logic, no dependencies.
 // Imported by nli-resolver.ts to keep that file under the 400-line limit.
@@ -234,15 +233,15 @@ export const ENTITY_SYNONYMS = {
 };
 /** Common framework names for entity extraction. */
 export const FRAMEWORK_KEYWORDS = [
-    'react',
-    'vue',
-    'angular',
+    technologyValue('technology-react-275976'),
+    technologyValue('technology-vue-564382'),
+    technologyValue('technology-angular-a39f89'),
     'next',
     'node',
-    'express',
-    'django',
-    'rails',
+    technologyValue('technology-express-008231'),
+    technologyValue('technology-django-7d8a08'),
+    technologyValue('technology-rails-2e1d59'),
     'spring',
-    'laravel',
+    technologyValue('technology-laravel-c34cfa'),
 ];
 //# sourceMappingURL=nli-keywords.js.map

package/dist/engine/oauth/config-guard.js

@@ -1,5 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
+import { technologyValue } from '../technology-registry.js';
 // src/engine/oauth/config-guard.ts — OAuth integration config + flow builder (SPEC-440)
 import { createOAuthState } from './state-manager.js';
 import { generateCodeChallenge } from './pkce.js';
@@ -7,7 +6,7 @@ import { findFreePort, startCallbackServer } from './local-server.js';
 const REDIRECT_URI = (port) => `http://localhost:${port}/callback`;
 function getIntegrationDef(integration) {
     switch (integration) {
-        case 'figma':
+        case technologyValue('technology-figma-5b79d0'):
             return {
                 flowType: 'oauth2-pkce',
                 clientId: process.env.PLANU_FIGMA_CLIENT_ID ?? 'planu-figma-app',
@@ -23,12 +22,12 @@ function getIntegrationDef(integration) {
                 tokenUrl: 'https://github.com/login/oauth/access_token',
                 scope: 'repo read:user',
             };
-        case 'sentry':
+        case technologyValue('technology-sentry-0cf685'):
             return {
                 flowType: 'guided-token',
                 guidedMessage: "Ve a https://sentry.io/settings/account/api/auth-tokens/new/ → crea un token con scope 'project:read event:read' → pega el token en configure_sentry",
             };
-        case 'supabase':
+        case technologyValue('technology-supabase-4d7594'):
             return {
                 flowType: 'guided-token',
                 guidedMessage: "Ve a https://supabase.com/dashboard/project/_/settings/api → copia la 'service_role' key → pega el valor en configure_supabase",

package/dist/engine/observability/local-execution-spans.d.ts

@@ -0,0 +1,15 @@
+import type { LocalExecutionSpanEvent, LocalExecutionSpanInput } from '../../types/observability.js';
+export declare function readLocalExecutionSpans(): readonly LocalExecutionSpanEvent[];
+export declare function clearLocalExecutionSpans(): void;
+/** Always-on, bounded local span. It performs no network export. */
+export declare class LocalExecutionSpan {
+    private timeoutRecorded;
+    private completionRecorded;
+    private readonly base;
+    constructor(input: LocalExecutionSpanInput);
+    get didTimeout(): boolean;
+    timeout(phase: string, commitState: string): void;
+    complete(phase: string, commitState: string): void;
+    private record;
+}
+//# sourceMappingURL=local-execution-spans.d.ts.map

package/dist/engine/observability/local-execution-spans.js

@@ -0,0 +1,63 @@
+import { redactText } from '../../security/redactor.js';
+const MAX_LOCAL_EVENTS = 1_000;
+const events = [];
+function append(event) {
+    events.push(event);
+    if (events.length > MAX_LOCAL_EVENTS) {
+        events.splice(0, events.length - MAX_LOCAL_EVENTS);
+    }
+}
+export function readLocalExecutionSpans() {
+    return events.map((event) => ({ ...event }));
+}
+export function clearLocalExecutionSpans() {
+    events.length = 0;
+}
+/** Always-on, bounded local span. It performs no network export. */
+export class LocalExecutionSpan {
+    timeoutRecorded = false;
+    completionRecorded = false;
+    base;
+    constructor(input) {
+        this.base = {
+            requestId: redactText(input.requestId),
+            operationId: redactText(input.operationId),
+            operation: redactText(input.operation),
+            deadlineAt: input.deadlineAt,
+            lockWaitMs: input.lockWaitMs ?? 0,
+            files: input.files ?? 0,
+            bytes: input.bytes ?? 0,
+            subprocess: input.subprocess ?? false,
+        };
+        this.record('start', 'running', false, 'pre-commit', false);
+    }
+    get didTimeout() {
+        return this.timeoutRecorded;
+    }
+    timeout(phase, commitState) {
+        if (this.timeoutRecorded) {
+            return;
+        }
+        this.timeoutRecorded = true;
+        this.record('timeout', phase, true, commitState, false);
+    }
+    complete(phase, commitState) {
+        if (this.completionRecorded) {
+            return;
+        }
+        this.completionRecorded = true;
+        this.record(this.timeoutRecorded ? 'late-completion' : 'complete', phase, phase === 'cancelled', commitState, this.timeoutRecorded);
+    }
+    record(kind, phase, cancelled, commitState, lateCompletion) {
+        append({
+            ...this.base,
+            kind,
+            occurredAt: new Date().toISOString(),
+            phase,
+            cancelled,
+            commitState,
+            lateCompletion,
+        });
+    }
+}
+//# sourceMappingURL=local-execution-spans.js.map

package/dist/engine/orchestrator/runtime.js

@@ -136,7 +136,6 @@ async function executeOrchestration(session, agentConfigs, tracker, config) {
     if (ramDecision.allowed < ramDecision.requested) {
         sendTelemetryEvent({
             event: 'ram_guardrail_downgrade',
-            installationId: 'anonymous',
             properties: {
                 requested: ramDecision.requested,
                 allowed: ramDecision.allowed,

package/dist/engine/package-registry.js

@@ -1,8 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-// Planu — Package Registry Clients
-// Queries npm, PyPI, crates.io, pkg.go.dev, packagist for latest versions.
-// Uses globalThis.fetch (Node.js 22+) — no external HTTP dependencies.
+import { technologyValue } from './technology-registry.js';
 // === Registry URL templates ===
 const REGISTRY_URLS = {
     npm: 'https://registry.npmjs.org/{name}',
@@ -68,7 +64,7 @@ export function detectRegistry(packageName, language) {
     if (lang === 'php') {
         return 'packagist';
     }
-    if (lang === 'dart' || lang === 'flutter') {
+    if (lang === 'dart' || lang === technologyValue('technology-flutter-be1396')) {
         return 'pub';
     }
     if (lang === 'csharp' || lang === 'c#' || lang === 'dotnet') {

package/dist/engine/performance-analyzer.js

@@ -1,7 +1,4 @@
-// engine/performance-analyzer.ts — SPEC-300: Detect performance risks in spec text
-//
-// Analyzes spec content for common performance anti-patterns using keyword matching.
-// Detection is intentionally conservative: negate keywords prevent false positives.
+import { technologyValue } from './technology-registry.js';
 // ---------------------------------------------------------------------------
 // Risk pattern definitions
 // ---------------------------------------------------------------------------
@@ -50,7 +47,7 @@ export const RISK_PATTERNS = [
         category: 'missing-cache',
         severity: 'medium',
         triggerKeywords: ['real-time', 'always fresh', 'live data', 'no cache', 'every request'],
-        negateIfPresent: ['cache', 'ttl', 'redis', 'memoize', 'cdn'],
+        negateIfPresent: ['cache', 'ttl', technologyValue('technology-redis-34fb46'), 'memoize', 'cdn'],
         description: 'Spec requires fresh data on every request with no caching strategy, risking high DB load.',
         recommendation: 'Define an appropriate TTL or cache invalidation strategy (Redis, CDN, in-memory).',
     },

package/dist/engine/permissions-merger/stack-detectors.js

@@ -1,13 +1,14 @@
 // @crash-shield-ignore-file — config/cache reader for Planu-controlled JSON; writer is this codebase, shape guaranteed by build/seed.
 // engine/permissions-merger/stack-detectors.ts — Stack-aware deny rule injection (SPEC-594 + SPEC-597)
 //
-// Registry-driven: reads src/config/deny-rules-registry.json + src/config/detection-signals.json
+// Registry-driven: reads deny rules plus the validated technology authority.
 // as the sources of truth. Zero hardcoded framework/deploy-target names in this file.
 // Adding a new stack = edit the JSON registries, never this file.
 import { access, readFile } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, resolve as pathResolve } from 'node:path';
 import { detectStack } from '../project-dna/stack-detector.js';
+import { loadTechnologyRegistry } from '../technology-registry.js';
 let denyRegistryCache = null;
 let signalsRegistryCache = null;
 function registryDir() {
@@ -24,12 +25,11 @@ async function loadDenyRegistry() {
     denyRegistryCache = JSON.parse(raw);
     return denyRegistryCache;
 }
-async function loadSignalsRegistry() {
+function loadSignalsRegistry() {
     if (signalsRegistryCache) {
         return signalsRegistryCache;
     }
-    const raw = await readFile(join(registryDir(), 'detection-signals.json'), 'utf-8');
-    signalsRegistryCache = JSON.parse(raw);
+    signalsRegistryCache = loadTechnologyRegistry();
     return signalsRegistryCache;
 }
 /** Test helper — clears both registry caches. Production never calls this. */
@@ -52,7 +52,7 @@ async function fileExists(filePath) {
  * the `deployTargets` + `databases` entries loaded from JSON.
  */
 async function detectStackFromFiles(projectPath) {
-    const registry = await loadSignalsRegistry();
+    const registry = loadSignalsRegistry();
     const tokens = new Set();
     for (const target of [...registry.deployTargets, ...registry.databases]) {
         if (target.type !== 'file') {

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -0,0 +1,39 @@
+{
+  "schemaVersion": 2,
+  "cliVersion": "4.14.1",
+  "engineVersion": "4.14.1",
+  "buildId": "1-4.14.1-aarch64-apple-darwin",
+  "protocolAbi": 1,
+  "capabilityAbi": 2,
+  "nodeApiAbi": 4,
+  "capabilities": [
+    "core-acceleration-v1",
+    "project-graph-v1",
+    "macos-keychain-v1"
+  ],
+  "storageSchemaMin": 4,
+  "storageSchemaMax": 4,
+  "target": "darwin-arm64",
+  "platform": "darwin",
+  "arch": "arm64",
+  "libc": null,
+  "artifactSha256": "5e2c55c2f381c543c0909efb8bc183ba9bbd44f8c4f5faacc61bb6d0a603e794",
+  "sbom": {
+    "format": "CycloneDX-1.5",
+    "path": "planu-core.darwin-arm64.node.sbom.json",
+    "sha256": "04829beb5af09b1b805f3454bf58f9cbff09b6d6b08a18f9cf0591172d7cc413"
+  },
+  "provenance": {
+    "builder": "scripts/build-rust-local.sh",
+    "sourceCommit": "6f1f1f95b8f68ae5e9987ef924987e1e9112b27a",
+    "sourceTreeDirty": false,
+    "sourceDateEpoch": 1,
+    "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
+    "zigVersion": "0.16.0"
+  },
+  "signature": {
+    "algorithm": "Ed25519",
+    "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
+    "value": "vi1PiQ/jDc4F21zckyqwUSUPqCDb1qsp/UY7HO+a2puJBml0yh8WJKhvcQZ6RRyDZDrApq078WcNsGhncR+EBg=="
+  }
+}