@planu/cli 4.13.0 → 5.0.0

package/CHANGELOG.md

@@ -1,3 +1,66 @@
+## [5.0.0] - 2026-07-31
+
+### Breaking Changes
+
+- Removed Planu commercial plans, license activation, trials, project/spec
+  limits, daily commercial quotas, and the Lemon Squeezy entitlement surface.
+- All local tools are available without payment under the Planu Proprietary
+  Free-Use License. The official unmodified package may be used commercially or
+  non-commercially with unlimited users and instances; the repository and
+  TypeScript implementation remain private and proprietary.
+- Removed the public license commands, entitlement fields, environment
+  variables, and tier-based tool metadata. Consumers must remove those obsolete
+  fields instead of relying on compatibility aliases.
+- Removed the orphaned `product-intelligence` public types and embedded
+  telemetry/feedback project endpoints and credentials. Telemetry delivery now
+  requires explicit `PLANU_TELEMETRY_ENDPOINT` and `PLANU_TELEMETRY_TOKEN`
+  configuration; remote feedback requires `PLANU_FEEDBACK_ENDPOINT`.
+
+### Security and Distribution
+
+- Preserved engineering budgets, hosted authentication and authorization,
+  transport abuse controls, dependency-license auditing, model pricing, runtime
+  timeouts, local usage health, and generic outbound webhooks.
+- Added narrow, idempotent cleanup for obsolete commercial state and a forward
+  Supabase migration that removes trial data without rewriting migration history.
+- Hardened npm packaging to allow public `.d.ts` declarations while rejecting
+  implementation `.ts`, source maps, embedded sources, personal paths, and
+  personal identity metadata.
+
+### Community
+
+- Kept direct BTC, ETH, and SOL donations, sponsorship channels, testimonials,
+  and the disabled-until-configured newsletter contract.
+
+## [4.14.1] - 2026-07-29
+
+### Bug Fixes
+- fix(release): defer native install verification
+- fix(release): make local artifacts authoritative
+
+
+## [4.14.0] - 2026-07-29
+
+### Features
+- feat: make Planu local-first and harden release integrity
+
+### Bug Fixes
+- fix(native): constrain napi generator compatibility
+- fix(native): pin compatible napi code generator
+- fix(release): validate rebuilt native artifacts
+- fix(release): bump native build manifest
+- fix(release): synchronize session context version
+- fix: classify freshness degradation paths
+- fix: make validation freshness deterministic
+- fix: make transactional locks crash-safe
+- fix: benchmark native runtime in worker threads
+- fix: classify lock degradation paths
+- fix: await init repository hook writes
+- fix: make cross-process leases transactional
+- fix: publish cross-process locks atomically
+- fix: complete process cancellation before settling
+
+
 ## [4.13.0] - 2026-07-27
 
 ### Features
@@ -4445,4 +4508,4 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) · Versioning:
 - Mermaid diagram generation (architecture, sequence, state machine, ER, data flow)
 - Multi-language i18n (EN/ES/PT) for generated specs
 - Clean Architecture (hexagonal) — engine, tools, storage, types layers
-- 10,857 tests with ≥95% coverage
+- 10,857 tests with ≥95% coverage

package/LICENSE

@@ -1,16 +1,59 @@
+Planu Proprietary Free-Use License 1.0
+
 Copyright (c) 2026 Planu. All rights reserved.
 
-This software and associated documentation files (the "Software") are the
-proprietary property of Planu. Unauthorized copying, modification, distribution,
-or use of this Software, in whole or in part, is strictly prohibited without
-prior written permission from the copyright holder.
+1. Definitions
+
+"Official Package" means an unmodified Planu executable package made available
+by Planu through an authorized package registry or distribution channel. It
+includes the JavaScript runtime, native binaries, public type declarations,
+documentation, and other files intentionally included in that package.
+
+2. Free-use grant
+
+Subject to this license, Planu grants you a worldwide, royalty-free,
+non-exclusive, non-transferable license to install and execute Official
+Packages for commercial and non-commercial purposes, with no limit on users,
+projects, installations, or instances. You may make the internal copies
+reasonably necessary for npm installation, package caches, CI, containers,
+deployment, disaster recovery, and backups. Those copies must remain
+unmodified, be used only by you or your organization, and retain this license
+and all proprietary notices.
+
+3. Proprietary ownership and restrictions
+
+Planu and its licensors retain all right, title, and interest in the software,
+repository, implementation source code, and derivative works. This license
+does not grant source-code access or any open-source rights. Except where
+applicable law expressly prevents the restriction, you may not:
+
+- publish, disclose, sell, sublicense, or provide Planu implementation source;
+- modify, adapt, translate, reverse engineer, decompile, or create derivative
+  builds from an Official Package;
+- remove or alter copyright, license, attribution, or proprietary notices;
+- repackage, mirror, resell, sublicense, or publicly redistribute an Official
+  Package or a derived build; or
+- use Planu trademarks to imply endorsement or authorship of another product.
+
+Planu may separately authorize redistribution or modification in writing.
+
+4. Third-party components
+
+Third-party components remain subject to their own license terms. Those terms
+do not change the proprietary status of Planu's original implementation.
+
+5. Termination
+
+This license terminates automatically if you breach it. On termination, you
+must stop using Planu and delete copies under your control, except archival
+copies that applicable law requires you to retain.
+
+6. Disclaimer and limitation of liability
 
-The Software is provided "as is", without warranty of any kind, express or
-implied, including but not limited to the warranties of merchantability,
-fitness for a particular purpose, and noninfringement. In no event shall the
-authors or copyright holders be liable for any claim, damages, or other
-liability, whether in an action of contract, tort, or otherwise, arising from,
-out of, or in connection with the Software or the use or other dealings in the
-Software.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND
+NONINFRINGEMENT. TO THE MAXIMUM EXTENT PERMITTED BY LAW, PLANU AND ITS AUTHORS
+OR COPYRIGHT HOLDERS ARE NOT LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY
+ARISING FROM OR RELATED TO THE SOFTWARE OR ITS USE.
 
-For licensing inquiries, contact: hello@planu.dev
+For permissions beyond this license, contact hello@planu.dev.

package/README.md

@@ -7,21 +7,21 @@
 ![Rust](https://img.shields.io/badge/core-rust-orange)
 ![License](https://img.shields.io/badge/license-proprietary-blue)
 
-**[Documentation](https://planu.dev)** · **[Docs in Spanish](https://planu.dev/es)** · **[Docs in Portuguese](https://planu.dev/pt)**
+**[Documentation](https://planu.dev)** · **[Español (Latinoamérica)](https://planu.dev/es)** · **[Español (España)](https://planu.dev/es-ES)** · **[Português](https://planu.dev/pt)**
 
 ---
 
 ## What is Planu?
 
-Planu is the **complete Spec Driven Development stack** for AI coding agents — an MCP server that enforces a structured workflow from brainstorm to validation. Powered by a **native Rust core**, Planu provides the performance and reliability needed for large-scale AI development.
+Planu is a Spec Driven Development stack for AI coding agents: an MCP server and local CLI that move work from a reviewed specification to validation evidence. Supported installations can use the bundled native Rust core for selected local hot paths.
 
 **Spec first, always.** No approved spec means no code. This eliminates vibe-coding debt at scale.
 
-- **Native Rust Engine** — 10x faster project scanning, parallel hashing, and regex extraction.
-- **Instant Drift Detection** — OS-level file watcher reacts to changes with 0% CPU overhead.
+- **Native Rust Engine** — accelerates supported project scanning, hashing, and extraction paths.
+- **Local change detection** — observes project changes without requiring a hosted configuration service.
 - **Unified Spec Format** — Requirements and technical details in a single, context-efficient `spec.md`.
 - **Atomic Integrity** — Indestructible writes and **Freeze-on-done** immutability (P0).
-- **14 official MCP tools** for the complete SDD loop, with advanced workflows kept in skills, CLI commands, and internal pipelines.
+- **28 official MCP tools** for the public SDD surface, with advanced workflows kept in skills, CLI commands, and internal pipelines.
 - **Multi-agent compatible** — Optimized for Claude Code, Cursor, Windsurf, and Gemini CLI.
 
 ---
@@ -43,6 +43,8 @@ Add to your MCP client config (Claude Desktop: `~/Library/Application Support/Cl
 
 **Requirements:** Node.js >= 24. The native Rust core is bundled and auto-detected for macOS (Intel/M1), Linux, and Windows.
 
+**Upgrade safety:** stop every running Planu process before upgrading. Current releases use a single transactional SQLite lock authority with monotonic fencing; concurrent mixed-version execution is intentionally unsupported because older file-lock clients cannot participate in the same atomic protocol.
+
 ---
 
 ## The SDD Lifecycle
@@ -63,29 +65,27 @@ Planu runs follow-up actions automatically after each step:
 
 ---
 
-## Unified Spec Format (v3.0)
+## Artifact lifecycle
 
-Specs are context-efficient: **1 single file per spec** containing both functional requirements and technical implementation details.
+The portable contract stays small and versionable:
 
 ```
 planu/specs/SPEC-001-auth/
-└── spec.md       # Requirements + Technical + Criteria + Status
+└── spec.md       # Requirements, technical contract, criteria, and lifecycle status
 ```
 
-Criteria use **zero-ambiguity GIVEN/WHEN/THEN format** — ensuring your AI never misinterprets the goal.
-
----
+Operational evidence does not live beside `spec.md`. Planu stores it in the external project data directory for the logical project:
 
-## Native Performance (v3.0)
+| Artifact | Purpose | Lifecycle |
+|---|---|---|
+| `discovery.json` | Rules, examples, open questions, scope boundaries, and glossary used before approval | Created/reviewed before `approved` |
+| `task-plan.json` | Implementation tasks mapped to acceptance criteria | Required before `implementing` |
+| `traceability-matrix.json` | Links every criterion to changed files and test/review evidence | Required before `done` |
+| `contract-validation-*.json` | API, GraphQL, event, UI, or MCP contract results when applicable | Produced during validation |
+| validation receipts and logs | Immutable result identity plus content-addressed command output | Persisted after validation |
+| durable jobs | Local execution state, progress, cancellation, deadlines, and terminal outcome | Persisted in the runtime database across process restarts |
 
-Planu v3.0 introduces **The Rust Revolution**:
-
-| Feature | Node.js (Legacy) | **Planu-RS (v3.0)** | Benefit |
-|---------|:----------------:|:-------------------:|:-------:|
-| Project Scanning | Sequential (Slow) | **Parallel (Rayon)** | **10x Speedup** |
-| File Watching | Polling/Event Loop | **OS-level (Notify)** | **0% CPU Idle** |
-| Spec Hashing | JS Crypto | **Native SHA-256** | Instant Sync |
-| Drift Monitor | Memory Heavy | **Streaming Scan** | Monorepo Ready |
+The external root follows the operating system's application-data convention and can be redirected with `PLANU_HOME`. Project evidence is stored under `<data>/projects/<logical-project-id>/`; durable jobs and authentic validation receipts are stored in `<data>/runtime/planu.sqlite3`. These files are machine-local by default, while `planu/specs/<id>/spec.md` remains the version-controlled source of truth.
 
 ---
 
@@ -99,13 +99,13 @@ src/
 ├── storage/          # Atomic persistence layer
 └── types/            # Strict TypeScript contracts
 
-~/.planu/data/             # Local execution state (outside the repository)
-├── projects/{hash}/      # Evidence, handoffs, reviews, and runtime state
-└── global/               # Shared templates and configuration
+<data>/                     # Resolved platform-specific Planu data root
+├── projects/<logical-project-id>/ # Evidence, handoffs, reviews, and projections
+└── runtime/planu.sqlite3           # Durable jobs, receipts, indexes, and audit state
 
 planu/                     # Portable, version-controlled project contract
 ├── specs/{spec}/spec.md  # Canonical specifications
-└── session.json          # Lightweight project/session index
+└── project.json          # Portable logical project identity
 ```
 
 ---
@@ -126,4 +126,12 @@ pnpm release:local # Local-first release flow when shipping
 
 ## License
 
-Planu is proprietary software. See the [license terms](LICENSE) for permitted use and distribution restrictions.
+Planu is proprietary, free-use software. The official unmodified package may be
+installed and executed without payment for commercial and non-commercial work,
+with unlimited users and instances. Internal copies needed for npm caches, CI,
+containers, deployment, and backups are permitted. The repository and
+TypeScript implementation sources remain private; modification, repackaging,
+derived builds, and public redistribution are restricted. Distributed
+JavaScript remains readable and is not represented as secret.
+
+See the [Planu Proprietary Free-Use License](LICENSE) for the complete terms.

package/dist/cli/commands/inspect.d.ts

@@ -0,0 +1,4 @@
+import type { CliCommand } from '../../types/cli.js';
+export declare function buildInspectionReport(): Promise<Record<string, unknown>>;
+export declare const inspectCommand: CliCommand;
+//# sourceMappingURL=inspect.d.ts.map

package/dist/cli/commands/inspect.js

@@ -0,0 +1,144 @@
+import { lstat, readdir } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { basename, isAbsolute, join, relative, sep } from 'node:path';
+import { homedir } from 'node:os';
+import { PLANU_VERSION } from '../../config/version.js';
+import { createStorageCatalog } from '../../storage/storage-catalog.js';
+import { resolveStorageLayout } from '../../storage/storage-layout.js';
+import { NATIVE_CAPABILITY_ABI, NATIVE_PROTOCOL_ABI, RUNTIME_STORAGE_SCHEMA, nativeLoadDiagnostic, } from '../../engine/core-bridge.js';
+import { readInstallationManifest } from './install.js';
+import { getProjects } from '../../storage/global-projects-store.js';
+async function inspectPath(path) {
+    try {
+        const info = await lstat(path);
+        if (info.isSymbolicLink()) {
+            return { path, exists: true, bytes: 0, mode: (info.mode & 0o777).toString(8) };
+        }
+        if (!info.isDirectory()) {
+            return { path, exists: true, bytes: info.size, mode: (info.mode & 0o777).toString(8) };
+        }
+        let bytes = 0;
+        for (const entry of await readdir(path, { withFileTypes: true })) {
+            if (entry.isSymbolicLink()) {
+                continue;
+            }
+            bytes += (await inspectPath(`${path}/${entry.name}`)).bytes;
+        }
+        return { path, exists: true, bytes, mode: (info.mode & 0o777).toString(8) };
+    }
+    catch (error) {
+        if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+            return { path, exists: false, bytes: 0 };
+        }
+        throw error;
+    }
+}
+export async function buildInspectionReport() {
+    const layout = resolveStorageLayout();
+    const portablePath = (path) => {
+        const roots = [
+            ['<runtime-db>', layout.runtimeDatabase],
+            ['<installation-manifest>', layout.installationManifest],
+            ['<projects>', layout.projects],
+            ['<native-cache>', layout.nativeCache],
+            ['<trash>', layout.trash],
+            ['<config>', layout.config],
+            ['<data>', layout.data],
+            ['<cache>', layout.cache],
+            ['<state>', layout.state],
+            ['<logs>', layout.logs],
+            ['<secrets>', layout.secrets],
+            ['<home>', homedir()],
+        ];
+        for (const [token, root] of roots.sort((left, right) => right[1].length - left[1].length)) {
+            const suffix = relative(root, path);
+            if (suffix === '') {
+                return token;
+            }
+            if (!suffix.startsWith(`..${sep}`) && suffix !== '..' && !isAbsolute(suffix)) {
+                return `${token}/${suffix.split(sep).join('/')}`;
+            }
+        }
+        return isAbsolute(path) ? `<absolute>/${basename(path)}` : path;
+    };
+    const sanitize = (value) => {
+        if (Array.isArray(value)) {
+            return value.map(sanitize);
+        }
+        if (value && typeof value === 'object') {
+            return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+                key,
+                sanitize(item),
+            ]));
+        }
+        return typeof value === 'string' && isAbsolute(value) ? portablePath(value) : value;
+    };
+    const layoutEntries = Object.entries(layout);
+    const roots = await Promise.all(layoutEntries.map(async ([kind, path]) => ({
+        kind,
+        ...(await inspectPath(path)),
+        path: portablePath(path),
+    })));
+    let installation = null;
+    if (existsSync(layout.installationManifest)) {
+        installation = sanitize(readInstallationManifest(layout.installationManifest));
+    }
+    const registered = await getProjects().catch(() => []);
+    const registeredHashes = new Set(registered.map((project) => project.hash));
+    const projectEntries = await readdir(layout.projects, { withFileTypes: true }).catch(() => []);
+    const orphanProjects = projectEntries
+        .filter((entry) => entry.isDirectory() && !registeredHashes.has(entry.name))
+        .map((entry) => entry.name);
+    const legacy = await Promise.all([
+        join(homedir(), '.planu'),
+        join(process.cwd(), /* @planu-storage-read-only legacy inspection */ '.planu'),
+    ].map(async (path) => ({
+        path: portablePath(path),
+        exists: (await inspectPath(path)).exists,
+    })));
+    const native = nativeLoadDiagnostic();
+    const displayArtifact = (value) => isAbsolute(value) ? `<local>/${basename(value)}` : value;
+    return {
+        schemaVersion: 1,
+        cliVersion: PLANU_VERSION,
+        offline: process.env.PLANU_OFFLINE === '1',
+        native: {
+            loaded: native.loaded ? displayArtifact(native.loaded) : null,
+            compatibility: native.compatibility ?? null,
+            attempted: native.attempted.map(displayArtifact),
+            errorCount: native.errors.length,
+            capabilities: native.capabilities ?? [],
+            executionScope: native.executionScope ?? null,
+            protocolAbi: NATIVE_PROTOCOL_ABI,
+            capabilityAbi: NATIVE_CAPABILITY_ABI,
+            storageSchema: RUNTIME_STORAGE_SCHEMA,
+        },
+        installation,
+        hostAdapters: installation && typeof installation === 'object' && 'installations' in installation
+            ? installation.installations
+            : [],
+        roots,
+        artifacts: sanitize(createStorageCatalog({ layout })),
+        legacy,
+        orphanProjects,
+        networkPolicy: {
+            offlineEnforced: process.env.PLANU_OFFLINE === '1',
+            fetchGuard: true,
+            directHttpsGuard: true,
+        },
+    };
+}
+export const inspectCommand = {
+    name: 'inspect',
+    description: 'Report local versions, storage, permissions and host adapters',
+    usage: 'planu inspect [--json]',
+    async run(_args, flags) {
+        const report = await buildInspectionReport();
+        if (flags?.json) {
+            process.stdout.write(`${JSON.stringify(report)}\n`);
+            return;
+        }
+        process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    },
+};
+//# sourceMappingURL=inspect.js.map

package/dist/cli/commands/install.d.ts

@@ -1,9 +1,4 @@
 import type { CliCommand } from '../../types/cli.js';
-export interface LicenseActivationResult {
-    key: string;
-    customerEmail: string;
-    variantName: string;
-}
 interface McpEntry {
     command: string;
     args: string[];
@@ -31,18 +26,30 @@ interface ToolDefinition {
     projectScopePath: string | null;
     format: 'standard' | 'zed';
 }
-declare function buildMcpEntry(licenseKey?: string): McpEntry;
+export interface InstallationRecord {
+    host: string;
+    configPath: string;
+    format: ToolDefinition['format'];
+    scope: 'user' | 'project';
+    package: string;
+    version: string;
+    offline: boolean;
+    installedAt: string;
+}
+export interface InstallationManifest {
+    schemaVersion: 1;
+    updatedAt: string;
+    installations: InstallationRecord[];
+}
+declare function buildMcpEntry(): McpEntry;
 declare function readJsonFile(filePath: string): ToolConfig;
 declare function hasPlanuEntry(config: ToolConfig, format: ToolDefinition['format']): boolean;
+export declare function readInstallationManifest(manifestPath: string): InstallationManifest;
+export declare function recordInstallation(manifestPath: string, record: InstallationRecord): InstallationManifest;
+export declare function removeInstallationRecords(manifestPath: string, removedConfigPaths: ReadonlySet<string>): InstallationManifest;
 declare function writeStandardEntry(filePath: string, entry: McpEntry): void;
 declare function writeZedEntry(filePath: string, entry: McpEntry): void;
 declare function removeEntry(filePath: string, format: ToolDefinition['format']): void;
-/**
- * Prompt the user for a license key and activate it.
- * Returns the activation result or null if the user skips.
- * In CI/headless mode (SDD_OWNER_TOKEN already set), returns a synthetic result immediately.
- */
-export declare function promptLicense(): Promise<LicenseActivationResult | null>;
 export { buildMcpEntry, readJsonFile, hasPlanuEntry, writeStandardEntry, writeZedEntry, removeEntry, };
 export declare const installCommand: CliCommand;
 //# sourceMappingURL=install.d.ts.map