@planu/cli 4.12.3 → 4.14.1

package/dist/engine/web-fetcher/stack-detector.js

@@ -1,34 +1,43 @@
-// Planu — Web Fetcher: Stack Detection from text and file paths (SPEC-382)
-// SPEC-597-EXEMPT: regex patterns + canonical labels for free-form text scanning.
-// Different surface than detection-signals.json (which targets project files,
-// not free-text web content). Migration pending a unified detection registry.
+import { technologyValue } from '../technology-registry.js';
 // ~50 well-known technologies with their normalized names
 const KNOWN_TECHS = [
-    { pattern: /\bnext\.?js\b/i, normalized: 'next.js' },
-    { pattern: /\breact\b/i, normalized: 'react' },
-    { pattern: /\bvue\.?js\b|\bvuejs\b/i, normalized: 'vue' },
-    { pattern: /\bangular\b/i, normalized: 'angular' },
-    { pattern: /\bsvelte\b/i, normalized: 'svelte' },
-    { pattern: /\bastro\b/i, normalized: 'astro' },
-    { pattern: /\bremix\b/i, normalized: 'remix' },
+    { pattern: /\bnext\.?js\b/i, normalized: technologyValue('technology-next-js-0d857f') },
+    { pattern: /\breact\b/i, normalized: technologyValue('technology-react-275976') },
+    { pattern: /\bvue\.?js\b|\bvuejs\b/i, normalized: technologyValue('technology-vue-564382') },
+    { pattern: /\bangular\b/i, normalized: technologyValue('technology-angular-a39f89') },
+    { pattern: /\bsvelte\b/i, normalized: technologyValue('technology-svelte-c190ac') },
+    { pattern: /\bastro\b/i, normalized: technologyValue('technology-astro-23661e') },
+    { pattern: /\bremix\b/i, normalized: technologyValue('technology-remix-0c5d96') },
     { pattern: /\bsolid\.?js\b|\bsolidjs\b/i, normalized: 'solid.js' },
     { pattern: /\bqwik\b/i, normalized: 'qwik' },
-    { pattern: /\bnuxt\b/i, normalized: 'nuxt' },
+    { pattern: /\bnuxt\b/i, normalized: technologyValue('technology-nuxt-22c407') },
     { pattern: /\bgatsbyjs\b|\bgatsby\b/i, normalized: 'gatsby' },
-    { pattern: /\bexpress\.?js\b|\bexpressjs\b/i, normalized: 'express' },
+    {
+        pattern: /\bexpress\.?js\b|\bexpressjs\b/i,
+        normalized: technologyValue('technology-express-008231'),
+    },
     { pattern: /\bhono\b/i, normalized: 'hono' },
-    { pattern: /\bfastify\b/i, normalized: 'fastify' },
+    { pattern: /\bfastify\b/i, normalized: technologyValue('technology-fastify-cbe57e') },
     { pattern: /\bkoa\b/i, normalized: 'koa' },
-    { pattern: /\bnestjs\b|\bnest\.js\b/i, normalized: 'nestjs' },
-    { pattern: /\bdjango\b/i, normalized: 'django' },
-    { pattern: /\bflask\b/i, normalized: 'flask' },
-    { pattern: /\bfastapi\b/i, normalized: 'fastapi' },
-    { pattern: /\brails\b|\bruby on rails\b/i, normalized: 'rails' },
-    { pattern: /\blaravel\b/i, normalized: 'laravel' },
+    { pattern: /\bnestjs\b|\bnest\.js\b/i, normalized: technologyValue('technology-nestjs-2d0087') },
+    { pattern: /\bdjango\b/i, normalized: technologyValue('technology-django-7d8a08') },
+    { pattern: /\bflask\b/i, normalized: technologyValue('technology-flask-b87aa5') },
+    { pattern: /\bfastapi\b/i, normalized: technologyValue('technology-fastapi-6aee0e') },
+    {
+        pattern: /\brails\b|\bruby on rails\b/i,
+        normalized: technologyValue('technology-rails-2e1d59'),
+    },
+    { pattern: /\blaravel\b/i, normalized: technologyValue('technology-laravel-c34cfa') },
     { pattern: /\bspring boot\b|\bspringboot\b/i, normalized: 'spring' },
-    { pattern: /\bgin\b.{0,10}\bgo\b|\bgo\b.{0,10}\bgin\b/i, normalized: 'gin' },
-    { pattern: /\bfiber\b.{0,10}\bgo\b|\bgo\b.{0,10}\bfiber\b/i, normalized: 'fiber' },
-    { pattern: /\btypescript\b/i, normalized: 'typescript' },
+    {
+        pattern: /\bgin\b.{0,10}\bgo\b|\bgo\b.{0,10}\bgin\b/i,
+        normalized: technologyValue('technology-gin-985adc'),
+    },
+    {
+        pattern: /\bfiber\b.{0,10}\bgo\b|\bgo\b.{0,10}\bfiber\b/i,
+        normalized: technologyValue('technology-fiber-77c3e6'),
+    },
+    { pattern: /\btypescript\b/i, normalized: technologyValue('technology-typescript-969545') },
     { pattern: /\bjavascript\b/i, normalized: 'javascript' },
     { pattern: /\bpython\b/i, normalized: 'python' },
     { pattern: /\bgolang\b|\bgo lang\b|\b(?:^|\s)go(?:\s|$)\b/i, normalized: 'go' },
@@ -36,28 +45,31 @@ const KNOWN_TECHS = [
     { pattern: /\bjava\b/i, normalized: 'java' },
     { pattern: /\bkotlin\b/i, normalized: 'kotlin' },
     { pattern: /\bswift\b/i, normalized: 'swift' },
-    { pattern: /\bflutter\b/i, normalized: 'flutter' },
+    { pattern: /\bflutter\b/i, normalized: technologyValue('technology-flutter-be1396') },
     { pattern: /\bexpo\b/i, normalized: 'expo' },
     { pattern: /\breact native\b|\breact-native\b/i, normalized: 'react-native' },
     { pattern: /\bpostgresql\b|\bpostgres\b/i, normalized: 'postgresql' },
     { pattern: /\bmysql\b/i, normalized: 'mysql' },
     { pattern: /\bmongodb\b|\bmongo\b/i, normalized: 'mongodb' },
     { pattern: /\bsqlite\b/i, normalized: 'sqlite' },
-    { pattern: /\bsupabase\b/i, normalized: 'supabase' },
+    { pattern: /\bsupabase\b/i, normalized: technologyValue('technology-supabase-4d7594') },
     { pattern: /\bfirebase\b/i, normalized: 'firebase' },
-    { pattern: /\bprisma\b/i, normalized: 'prisma' },
-    { pattern: /\bdrizzle\b/i, normalized: 'drizzle' },
-    { pattern: /\btailwind\b/i, normalized: 'tailwind' },
+    { pattern: /\bprisma\b/i, normalized: technologyValue('technology-prisma-99497c') },
+    { pattern: /\bdrizzle\b/i, normalized: technologyValue('technology-drizzle-424f22') },
+    { pattern: /\btailwind\b/i, normalized: technologyValue('technology-tailwind-44c8cf') },
     { pattern: /\bvite\b/i, normalized: 'vite' },
-    { pattern: /\bvitest\b/i, normalized: 'vitest' },
-    { pattern: /\bjest\b/i, normalized: 'jest' },
-    { pattern: /\bdocker\b/i, normalized: 'docker' },
-    { pattern: /\bkubernetes\b|\bk8s\b/i, normalized: 'kubernetes' },
-    { pattern: /\bstripe\b/i, normalized: 'stripe' },
-    { pattern: /\bgraphql\b/i, normalized: 'graphql' },
-    { pattern: /\btrpc\b/i, normalized: 'trpc' },
-    { pattern: /\bzod\b/i, normalized: 'zod' },
-    { pattern: /\bprisma\b/i, normalized: 'prisma' },
+    { pattern: /\bvitest\b/i, normalized: technologyValue('technology-vitest-a9127f') },
+    { pattern: /\bjest\b/i, normalized: technologyValue('technology-jest-35e99f') },
+    { pattern: /\bdocker\b/i, normalized: technologyValue('technology-docker-d548c5') },
+    {
+        pattern: /\bkubernetes\b|\bk8s\b/i,
+        normalized: technologyValue('technology-kubernetes-94abcb'),
+    },
+    { pattern: /\bstripe\b/i, normalized: technologyValue('technology-stripe-2bed20') },
+    { pattern: /\bgraphql\b/i, normalized: technologyValue('technology-graphql-aed31c') },
+    { pattern: /\btrpc\b/i, normalized: technologyValue('technology-trpc-7a75ed') },
+    { pattern: /\bzod\b/i, normalized: technologyValue('technology-zod-4f63cf') },
+    { pattern: /\bprisma\b/i, normalized: technologyValue('technology-prisma-99497c') },
 ];
 // npm package pattern: word with hyphen or scoped (@scope/pkg)
 const NPM_PACKAGE_RE = /(?:^|\s)((?:@[\w-]+\/[\w-]+|[\w][\w-]{1,}))(?=\s|$)/g;
@@ -112,33 +124,81 @@ export function detectTechsFromText(text) {
 }
 const FILE_TECH_MAP = [
     { pattern: /package\.json$/, name: 'node', confidence: 'high' },
-    { pattern: /next\.config\.[cm]?[jt]s$/, name: 'next.js', confidence: 'high' },
+    {
+        pattern: /next\.config\.[cm]?[jt]s$/,
+        name: technologyValue('technology-next-js-0d857f'),
+        confidence: 'high',
+    },
     { pattern: /vite\.config\.[cm]?[jt]s$/, name: 'vite', confidence: 'high' },
-    { pattern: /vitest\.config\.[cm]?[jt]s$/, name: 'vitest', confidence: 'high' },
-    { pattern: /astro\.config\.[cm]?[jt]s$/, name: 'astro', confidence: 'high' },
-    { pattern: /remix\.config\.[cm]?[jt]s$/, name: 'remix', confidence: 'high' },
-    { pattern: /svelte\.config\.[cm]?[jt]s$/, name: 'svelte', confidence: 'high' },
-    { pattern: /nuxt\.config\.[cm]?[jt]s$/, name: 'nuxt', confidence: 'high' },
-    { pattern: /tailwind\.config\.[cm]?[jt]s$/, name: 'tailwind', confidence: 'high' },
-    { pattern: /prisma\/schema\.prisma$|\.prisma$/, name: 'prisma', confidence: 'high' },
-    { pattern: /drizzle\.config\.[cm]?[jt]s$/, name: 'drizzle', confidence: 'high' },
-    { pattern: /Dockerfile$|docker-compose\.ya?ml$/, name: 'docker', confidence: 'high' },
+    {
+        pattern: /vitest\.config\.[cm]?[jt]s$/,
+        name: technologyValue('technology-vitest-a9127f'),
+        confidence: 'high',
+    },
+    {
+        pattern: /astro\.config\.[cm]?[jt]s$/,
+        name: technologyValue('technology-astro-23661e'),
+        confidence: 'high',
+    },
+    {
+        pattern: /remix\.config\.[cm]?[jt]s$/,
+        name: technologyValue('technology-remix-0c5d96'),
+        confidence: 'high',
+    },
+    {
+        pattern: /svelte\.config\.[cm]?[jt]s$/,
+        name: technologyValue('technology-svelte-c190ac'),
+        confidence: 'high',
+    },
+    {
+        pattern: /nuxt\.config\.[cm]?[jt]s$/,
+        name: technologyValue('technology-nuxt-22c407'),
+        confidence: 'high',
+    },
+    {
+        pattern: /tailwind\.config\.[cm]?[jt]s$/,
+        name: technologyValue('technology-tailwind-44c8cf'),
+        confidence: 'high',
+    },
+    {
+        pattern: /prisma\/schema\.prisma$|\.prisma$/,
+        name: technologyValue('technology-prisma-99497c'),
+        confidence: 'high',
+    },
+    {
+        pattern: /drizzle\.config\.[cm]?[jt]s$/,
+        name: technologyValue('technology-drizzle-424f22'),
+        confidence: 'high',
+    },
+    {
+        pattern: /Dockerfile$|docker-compose\.ya?ml$/,
+        name: technologyValue('technology-docker-d548c5'),
+        confidence: 'high',
+    },
     { pattern: /requirements\.txt$|setup\.py$|pyproject\.toml$/, name: 'python', confidence: 'high' },
     { pattern: /go\.mod$|go\.sum$/, name: 'go', confidence: 'high' },
     { pattern: /Cargo\.toml$|Cargo\.lock$/, name: 'rust', confidence: 'high' },
     { pattern: /pom\.xml$|build\.gradle$/, name: 'java', confidence: 'high' },
-    { pattern: /tsconfig\.json$/, name: 'typescript', confidence: 'high' },
-    { pattern: /\.tsx?$/, name: 'typescript', confidence: 'medium' },
-    { pattern: /\.vue$/, name: 'vue', confidence: 'high' },
-    { pattern: /\.svelte$/, name: 'svelte', confidence: 'high' },
-    { pattern: /\.tsx$/, name: 'react', confidence: 'medium' },
-    { pattern: /\.jsx$/, name: 'react', confidence: 'medium' },
+    {
+        pattern: /tsconfig\.json$/,
+        name: technologyValue('technology-typescript-969545'),
+        confidence: 'high',
+    },
+    {
+        pattern: /\.tsx?$/,
+        name: technologyValue('technology-typescript-969545'),
+        confidence: 'medium',
+    },
+    { pattern: /\.vue$/, name: technologyValue('technology-vue-564382'), confidence: 'high' },
+    { pattern: /\.svelte$/, name: technologyValue('technology-svelte-c190ac'), confidence: 'high' },
+    { pattern: /\.tsx$/, name: technologyValue('technology-react-275976'), confidence: 'medium' },
+    { pattern: /\.jsx$/, name: technologyValue('technology-react-275976'), confidence: 'medium' },
     { pattern: /\.py$/, name: 'python', confidence: 'medium' },
     { pattern: /\.go$/, name: 'go', confidence: 'medium' },
     { pattern: /\.rs$/, name: 'rust', confidence: 'medium' },
     { pattern: /\.kt$/, name: 'kotlin', confidence: 'medium' },
     { pattern: /\.swift$/, name: 'swift', confidence: 'medium' },
-    { pattern: /\.dart$/, name: 'flutter', confidence: 'medium' },
+    { pattern: /\.dart$/, name: technologyValue('technology-flutter-be1396'), confidence: 'medium' },
 ];
 export function detectTechsFromFiles(fileList) {
     const found = new Map();

package/dist/engine/workspace-manager.js

@@ -3,15 +3,16 @@ import { getProjects, addProject } from '../storage/global-projects-store.js';
 import { specStore } from '../storage/index.js';
 import { hashProjectPath, readJson } from '../storage/base-store.js';
 import { glob } from 'glob';
+import { resolveStorageLayout } from '../storage/storage-layout.js';
 // ---------------------------------------------------------------------------
 // SPEC-789: Project discovery fallback
 // ---------------------------------------------------------------------------
 /**
  * Resolve the data/projects base directory.
- * Uses PLANU_PROJECTS_DIR env var for testability, falls back to `data/projects`.
+ * Uses the canonical platform storage layout and never depends on CWD.
  */
 function projectsBaseDir() {
-    return process.env.PLANU_PROJECTS_DIR ?? 'data/projects';
+    return resolveStorageLayout().projects;
 }
 /**
  * Walk `data/projects/{hash}/knowledge.json` to discover project paths that

package/dist/errors/classified-degradation.d.ts

@@ -0,0 +1,3 @@
+export declare function reportClassifiedDegradation(code: string, error: unknown): void;
+export declare function redactFailureMessage(error: unknown): string;
+//# sourceMappingURL=classified-degradation.d.ts.map

package/dist/errors/classified-degradation.js

@@ -0,0 +1,10 @@
+import { redactText } from '../security/redactor.js';
+import { emitClassifiedDegradation } from './degradation-sink.js';
+export function reportClassifiedDegradation(code, error) {
+    emitClassifiedDegradation(code, redactFailureMessage(error));
+}
+export function redactFailureMessage(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return redactText(message).slice(0, 300);
+}
+//# sourceMappingURL=classified-degradation.js.map

package/dist/errors/degradation-sink.d.ts

@@ -0,0 +1,3 @@
+/** Leaf logging boundary. Callers must pass only already-redacted detail. */
+export declare function emitClassifiedDegradation(code: string, error: string): void;
+//# sourceMappingURL=degradation-sink.d.ts.map

package/dist/errors/degradation-sink.js

@@ -0,0 +1,5 @@
+/** Leaf logging boundary. Callers must pass only already-redacted detail. */
+export function emitClassifiedDegradation(code, error) {
+    console.warn('[planu:degraded]', { code, error });
+}
+//# sourceMappingURL=degradation-sink.js.map

package/dist/errors/error-taxonomy.d.ts

@@ -0,0 +1,12 @@
+export declare const BOUNDARY_FAILURE_KINDS: readonly ['NotFound', 'Corrupt', 'IncompatibleVersion', 'PermissionDenied', 'ResourceExhausted', 'Conflict', 'Cancelled', 'DeadlineExceeded', 'DependencyUnavailable', 'Internal'];
+/** Typed, redacted failure safe to return across a process or tool boundary. */
+export declare class BoundaryFailure extends Error {
+    readonly kind: (typeof BOUNDARY_FAILURE_KINDS)[number];
+    readonly operation: string;
+    readonly remediation: string;
+    readonly retryable: boolean;
+    constructor(kind: (typeof BOUNDARY_FAILURE_KINDS)[number], operation: string, remediation: string, cause?: BoundaryFailure);
+}
+export declare function classifyBoundaryFailure(error: unknown, operation: string, remediation?: string): BoundaryFailure;
+export declare function isBoundaryFailure(value: unknown): value is BoundaryFailure;
+//# sourceMappingURL=error-taxonomy.d.ts.map

package/dist/errors/error-taxonomy.js

@@ -0,0 +1,62 @@
+import { redactText } from '../security/redactor.js';
+export const BOUNDARY_FAILURE_KINDS = [
+    'NotFound',
+    'Corrupt',
+    'IncompatibleVersion',
+    'PermissionDenied',
+    'ResourceExhausted',
+    'Conflict',
+    'Cancelled',
+    'DeadlineExceeded',
+    'DependencyUnavailable',
+    'Internal',
+];
+const RETRYABLE_KINDS = new Set([
+    'Conflict',
+    'ResourceExhausted',
+    'DependencyUnavailable',
+]);
+const NODE_ERROR_CLASSIFICATION = {
+    ENOENT: 'NotFound',
+    EACCES: 'PermissionDenied',
+    EPERM: 'PermissionDenied',
+    ENOSPC: 'ResourceExhausted',
+    EDQUOT: 'ResourceExhausted',
+    EEXIST: 'Conflict',
+    EBUSY: 'Conflict',
+    ECANCELED: 'Cancelled',
+    ABORT_ERR: 'Cancelled',
+    ETIMEDOUT: 'DeadlineExceeded',
+    ECONNREFUSED: 'DependencyUnavailable',
+    ECONNRESET: 'DependencyUnavailable',
+    ENETUNREACH: 'DependencyUnavailable',
+};
+/** Typed, redacted failure safe to return across a process or tool boundary. */
+export class BoundaryFailure extends Error {
+    kind;
+    operation;
+    remediation;
+    retryable;
+    constructor(kind, operation, remediation, cause) {
+        const safeOperation = redactText(operation).slice(0, 160);
+        const safeRemediation = redactText(remediation).slice(0, 512);
+        super(`[Planu] ${safeOperation} failed (${kind}). ${safeRemediation}`, cause === undefined ? undefined : { cause });
+        this.kind = kind;
+        this.operation = operation;
+        this.remediation = remediation;
+        this.name = 'BoundaryFailure';
+        this.retryable = RETRYABLE_KINDS.has(kind);
+    }
+}
+export function classifyBoundaryFailure(error, operation, remediation = 'Retry only after the reported condition has been resolved.') {
+    if (error instanceof BoundaryFailure) {
+        return error;
+    }
+    const code = error !== null && typeof error === 'object' && 'code' in error ? String(error.code) : undefined;
+    const kind = code === undefined ? 'Internal' : (NODE_ERROR_CLASSIFICATION[code] ?? 'Internal');
+    return new BoundaryFailure(kind, operation, remediation);
+}
+export function isBoundaryFailure(value) {
+    return value instanceof BoundaryFailure;
+}
+//# sourceMappingURL=error-taxonomy.js.map

package/dist/hosts/claude-code/ux/mcp-prompts.js

@@ -87,7 +87,7 @@ function buildExecuteSddFlowPrompt(specId, projectPath, mode) {
     const branchStep = mode !== 'implement-only'
         ? '4. Create a feature branch: `git checkout -b feat/' + specId + '-<slug>`.'
         : '4. Implement in the current branch (implement-only mode).';
-    const prStep = mode !== 'implement-only' ? '10. Open a PR with `create_pr_from_spec`.' : '';
+    const prStep = mode !== 'implement-only' ? '12. Open a PR with `create_pr_from_spec`.' : '';
     return [
         `You are implementing Planu spec \`${specId}\`${pathHint}${modeHint} using the full SDD flow.`,
         '',
@@ -101,11 +101,17 @@ function buildExecuteSddFlowPrompt(specId, projectPath, mode) {
         '5. Implement all source files following Clean Architecture: types → engine → storage → tools.',
         '6. Write tests mirroring `src/` structure in `tests/`. Coverage ≥ 95% on new files.',
         '7. Run `pnpm typecheck && pnpm lint && pnpm test:coverage` — fix all failures.',
-        '8. Call `validate({ specId: "' + specId + '" })` — fix any failing criteria.',
-        '9. Call `update_status({ specId: "' + specId + '", status: "done" })` when all criteria pass.',
+        '8. Call `validate({ specId: "' +
+            specId +
+            '" })` and capture the durable acknowledgement fields: `operationId`, `projectId`, `workspaceId`, and `cursor`.',
+        '9. Call `watch_job` with those identifiers and the latest cursor. Repeat while the job is non-terminal; do not treat an accepted or running job as a validation result.',
+        '10. Require terminal state `completed`, then inspect `job.result.structuredContent`. If the job is failed, dead-letter, or cancelled, stop and report it. Fix every failing criterion and submit a new validation job when needed.',
+        '11. Call `update_status({ specId: "' +
+            specId +
+            '", status: "done" })` only after the completed result reports `ready: true`, `status: "passing"`, and passing quality gates.',
         prStep,
         '',
-        'Never mark done until ALL acceptance criteria pass `validate`.',
+        'Never mark done from the validate acknowledgement. Mark done only after a completed durable job result confirms that ALL acceptance criteria and quality gates pass.',
     ]
         .filter(Boolean)
         .join('\n');

package/dist/hosts/claude-code/ux/mcp-resources.js

@@ -3,6 +3,8 @@
 // Resources are materialized on-demand (no streaming, no TTL cache — data is small JSON).
 import { readFile } from 'node:fs/promises';
 import { glob } from 'glob';
+import { resolveStorageLayout } from '../../../storage/storage-layout.js';
+import { join } from 'node:path';
 /** Planu-namespaced resource URIs exposed by SPEC-588. */
 export const PLANU_UX_RESOURCE_URIS = {
     specList: 'planu://ux/specs',
@@ -56,7 +58,7 @@ function safeStr(value) {
 async function loadAllSpecEntries() {
     const specs = [];
     try {
-        const files = await glob('data/projects/*/specs.json');
+        const files = await glob(join(resolveStorageLayout().projects, '*', 'specs.json'));
         for (const file of files) {
             try {
                 const raw = await readFile(file, 'utf-8');
@@ -103,7 +105,7 @@ async function buildProgressContent() {
 }
 async function buildConstitutionContent() {
     try {
-        const files = await glob('data/projects/*/constitution.json');
+        const files = await glob(join(resolveStorageLayout().projects, '*', 'constitution.json'));
         if (files.length > 0 && files[0]) {
             const raw = await readFile(files[0], 'utf-8');
             const parsed = JSON.parse(raw);

package/dist/hosts/codex/config-scaffold.js

@@ -13,6 +13,7 @@ import { join } from 'node:path';
 import { detectCodexWorkspace } from './workspace-scope.js';
 import { buildRulesForHost } from '../../engine/host-rules-templates/index.js';
 import { assertEnglishOnlyArtifactText } from '../../engine/spec-language/english-only.js';
+import { PLANU_VERSION } from '../../config/version.js';
 import { generateImplementerRole, generateReviewerRole, generateSpecWriterRole, } from '../../engine/ai-integration/codex/agent-roles-generator.js';
 const CODEX_CONFIG_TOML = `# .openai/config.toml — Planu Codex workspace configuration
 # Auto-generated by Planu init_project. Safe to customize.
@@ -25,7 +26,7 @@ const CODEX_CONFIG_TOML = `# .openai/config.toml — Planu Codex workspace confi
 name = "planu"
 transport = "stdio"
 command = "npx"
-args = ["@planu/cli@latest"]
+args = ["@planu/cli@__PLANU_VERSION__"]
 startup_timeout_sec = 120
 
 [workspace]
@@ -60,7 +61,7 @@ MCP server registered in .openai/config.toml.
  * `<!-- planu:rules:start -->` markers is replaced on subsequent runs.
  * Safe to call on non-Codex environments — skips silently unless markers are present.
  */
-export async function scaffoldCodexConfig(projectPath, planuVersion = '1.96.0') {
+export async function scaffoldCodexConfig(projectPath, planuVersion = PLANU_VERSION) {
     const markers = detectCodexWorkspace(projectPath);
     const isCodexEnv = markers.hasWorkspaceEnv || markers.hasCodexEnv || markers.isEnterprise;
     // Only scaffold if Codex env markers are present, or if .openai/ already exists
@@ -69,7 +70,7 @@ export async function scaffoldCodexConfig(projectPath, planuVersion = '1.96.0')
     }
     const openaiDir = join(projectPath, '.openai');
     await mkdir(openaiDir, { recursive: true });
-    await writeIfMissing(join(openaiDir, 'config.toml'), CODEX_CONFIG_TOML);
+    await writeIfMissing(join(openaiDir, 'config.toml'), CODEX_CONFIG_TOML.replace('__PLANU_VERSION__', planuVersion));
     await writeIfMissing(join(projectPath, 'AGENTS.md'), AGENTS_MD_CONTENT);
     await scaffoldCodexAgentRoles(projectPath);
     await injectRulesBlock(join(projectPath, 'AGENTS.md'), planuVersion);

package/dist/hosts/gemini/config-scaffold.js

@@ -6,6 +6,7 @@ import { writeFile, readFile, mkdir, access } from 'node:fs/promises';
 import { join } from 'node:path';
 import { buildRulesForHost } from '../../engine/host-rules-templates/index.js';
 import { assertEnglishOnlyArtifactText } from '../../engine/spec-language/english-only.js';
+import { PLANU_VERSION } from '../../config/version.js';
 // ---------------------------------------------------------------------------
 // File content generators
 // ---------------------------------------------------------------------------
@@ -125,7 +126,7 @@ function buildPostToolHookSh() {
  * Called by init_project when a Gemini workspace is detected.
  * Integration hook for handler.ts: see REPORT at end of implementation.
  */
-export async function scaffoldGeminiConfig(projectPath, planuVersion = '1.96.0') {
+export async function scaffoldGeminiConfig(projectPath, planuVersion = PLANU_VERSION) {
     const filesCreated = [];
     const filesSkipped = [];
     const filesToWrite = [

package/dist/hosts/gemini/multimodal-spec-flow.js

@@ -1,6 +1,4 @@
-// hosts/gemini/multimodal-spec-flow.ts — Multimodal-first spec creation pipeline (SPEC-591)
-// When Gemini provides an image attachment with a create_spec request,
-// automatically chains inject_component_context + figma-tokens extraction.
+import { technologyValue } from '../../engine/technology-registry.js';
 /** Image MIME types that trigger the multimodal spec pipeline */
 const IMAGE_MIME_TYPES = new Set([
     'image/png',
@@ -13,7 +11,12 @@ const IMAGE_MIME_TYPES = new Set([
 /** PDF MIME type */
 const PDF_MIME_TYPE = 'application/pdf';
 /** Figma export tokens detection heuristic — filename or metadata hint */
-const FIGMA_TOKEN_HINTS = ['figma', 'design-tokens', 'tokens.json', 'variables.json'];
+const FIGMA_TOKEN_HINTS = [
+    technologyValue('technology-figma-5b79d0'),
+    'design-tokens',
+    'tokens.json',
+    'variables.json',
+];
 /**
  * Analyse Gemini's multimodal content parts to determine input shape.
  * Does not perform I/O — purely inspects the attachment metadata.

package/dist/index.js

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
 // index.ts — Planu SDD MCP Server entry point.
 // Creates the MCP server, registers tools & resources, and starts stdio transport.
+import { installNetworkPolicy } from './engine/network-policy.js';
+installNetworkPolicy();
 // CLI detection — intercept known commands before MCP server setup (SPEC-124)
 const KNOWN_COMMANDS = [
     'init',
@@ -23,6 +25,9 @@ const KNOWN_COMMANDS = [
     'spec',
     'health',
     'release',
+    'storage',
+    'inspect',
+    'offline',
     'help',
     'version',
 ];
@@ -32,14 +37,16 @@ if (firstArg && KNOWN_COMMANDS.includes(firstArg)) {
     await route(process.argv.slice(2));
     process.exit(0);
 }
-// Minimal static imports — only what createMcpServer() needs at module load time.
+// Import the runtime only after the process-wide network policy is installed.
 // The official tool surface is registered in main() before transport connection
 // so the first MCP tools/list response is complete for hosts that ignore
 // notifications/tools/list_changed.
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { SERVER_INSTRUCTIONS } from './config/server-instructions.js';
-import { PLANU_VERSION } from './config/version.js';
-import { withToolTracking, getRegisteredTools } from './tools/tool-registry.js';
+const [{ McpServer }, { SERVER_INSTRUCTIONS }, { PLANU_VERSION }, { withToolTracking, getRegisteredTools },] = await Promise.all([
+    import('@modelcontextprotocol/sdk/server/mcp.js'),
+    import('./config/server-instructions.js'),
+    import('./config/version.js'),
+    import('./tools/tool-registry.js'),
+]);
 function createMcpServer() {
     const s = withToolTracking(new McpServer({ name: 'planu', version: PLANU_VERSION }, {
         instructions: SERVER_INSTRUCTIONS,
@@ -65,18 +72,23 @@ function scheduleStartupStateRecovery(startupSync, recoverPendingPostCommitTasks
         .then(() => recoverPendingPostCommitTasksAtStartup().catch((err) => {
         console.error('[Planu] Startup post-commit recovery failed:', err);
     }));
+    void import('./engine/execution/validate-job-executor.js').then(({ recoverValidateJobsAtStartup }) => {
+        recoverValidateJobsAtStartup();
+    });
 }
 // Loads post-handshake modules after the MCP handshake has completed.
 // Separated from main() to keep main() within the 80-line function budget.
+// eslint-disable-next-line max-lines-per-function -- startup dependency orchestration
 async function setupPostHandshake(handshakeGate, officialToolNames) {
     // Wait for initialize + notifications/initialized before firing any notifications.
     await handshakeGate;
     const envKey = process.env.SDD_LICENSE_KEY;
-    const [{ bootstrapAutopilotHandlers }, { registerAgentSquadHandlers }, { startupSync }, { recoverPendingPostCommitTasksAtStartup }, { checkForUpdates }, { setConnectedClient }, { handleActivateLicense }, { GroupManager }, { setGroupManager },] = await Promise.all([
+    const [{ bootstrapAutopilotHandlers }, { registerAgentSquadHandlers }, { startupSync }, { recoverPendingPostCommitTasksAtStartup }, { startSpecCreatedOutboxConsumer }, { checkForUpdates }, { setConnectedClient }, { handleActivateLicense }, { GroupManager }, { setGroupManager },] = await Promise.all([
         import('./engine/autopilot/bootstrap.js'),
         import('./tools/register-agent-squad-tools.js'),
         import('./tools/sync-spec-state-handler.js'),
         import('./tools/update-status/index.js'),
+        import('./tools/create-spec/spec-created-outbox-consumer.js'),
         import('./engine/update-notifier.js'),
         import('./engine/llm-runtime/index.js'),
         import('./tools/activate-license.js'),
@@ -115,6 +127,9 @@ async function setupPostHandshake(handshakeGate, officialToolNames) {
     })();
     // SPEC-334: Sync planu/ YAML frontmatter status → data/ store (non-blocking)
     scheduleStartupStateRecovery(startupSync, recoverPendingPostCommitTasksAtStartup);
+    await startSpecCreatedOutboxConsumer().catch((err) => {
+        console.error('[Planu] Startup spec.created outbox recovery failed:', err);
+    });
     // Auto-activate license from environment variable if present.
     if (envKey) {
         const { licenseStore: ls } = await import('./storage/index.js');

package/dist/resources/patterns.js

@@ -3,6 +3,8 @@
 import { readFile } from 'node:fs/promises';
 import { glob } from 'glob';
 import { t } from '../i18n/index.js';
+import { resolveStorageLayout } from '../storage/storage-layout.js';
+import { join } from 'node:path';
 /**
  * Scan the data/projects/ directory for pattern JSON files.
  * Patterns are stored in data/projects/{projectId}/patterns.json
@@ -10,7 +12,7 @@ import { t } from '../i18n/index.js';
 async function loadAllPatterns() {
     const allPatterns = [];
     try {
-        const patternFiles = await glob('data/projects/*/patterns.json');
+        const patternFiles = await glob(join(resolveStorageLayout().projects, '*', 'patterns.json'));
         for (const file of patternFiles) {
             try {
                 const raw = await readFile(file, 'utf-8');

package/dist/resources/specs.js

@@ -4,6 +4,8 @@
 import { readFile } from 'node:fs/promises';
 import { glob } from 'glob';
 import { t } from '../i18n/index.js';
+import { resolveStorageLayout } from '../storage/storage-layout.js';
+import { join } from 'node:path';
 /**
  * Scan the data/projects/ directory for all specs.json files and return them.
  * Each project stores ALL specs in a single data/projects/{projectId}/specs.json as an array.
@@ -11,7 +13,7 @@ import { t } from '../i18n/index.js';
 async function loadAllSpecs() {
     const specs = [];
     try {
-        const specFiles = await glob('data/projects/*/specs.json');
+        const specFiles = await glob(join(resolveStorageLayout().projects, '*', 'specs.json'));
         for (const file of specFiles) {
             try {
                 const raw = await readFile(file, 'utf-8');

package/dist/resources/templates.js

@@ -3,6 +3,8 @@
 import { readFile } from 'node:fs/promises';
 import { glob } from 'glob';
 import { t } from '../i18n/index.js';
+import { globalDataDir } from '../storage/base-store.js';
+import { join } from 'node:path';
 /**
  * Load built-in templates. These are the default SDD spec types.
  */
@@ -87,7 +89,7 @@ function getBuiltInTemplates() {
 async function loadCustomTemplates() {
     const templates = [];
     try {
-        const files = await glob('data/global/templates/*.json');
+        const files = await glob(join(globalDataDir(), 'templates', '*.json'));
         for (const file of files) {
             try {
                 const raw = await readFile(file, 'utf-8');

package/dist/security/adapters/environment.d.ts

@@ -0,0 +1,12 @@
+import type { SecretStoreAdapter } from '../../types/security.js';
+/** Explicit, read-only adapter. IDs must be mapped to named process environment variables. */
+export declare class EnvironmentSecretAdapter implements SecretStoreAdapter {
+    private readonly variables;
+    private readonly env;
+    readonly kind: 'environment';
+    constructor(variables: Readonly<Record<string, string>>, env?: NodeJS.ProcessEnv);
+    get(id: string): Promise<string | null>;
+    set(_id: string, _value: string): Promise<void>;
+    delete(_id: string): Promise<void>;
+}
+//# sourceMappingURL=environment.d.ts.map