@planu/cli 4.13.0 → 5.0.0

package/dist/engine/rules-generator/index.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../technology-registry.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { detectAiTools, getPrimaryAiTool } from '../ai-tool-detector/index.js';
@@ -120,15 +121,15 @@ export function detectArchitectureStack(projectPath) {
     if (existsSync(join(projectPath, 'next.config.js')) ||
         existsSync(join(projectPath, 'next.config.ts')) ||
         existsSync(join(projectPath, 'next.config.mjs'))) {
-        return 'nextjs';
+        return technologyValue('technology-nextjs-c93379');
     }
     // FastAPI detection
     const requirementsTxt = join(projectPath, 'requirements.txt');
     if (existsSync(requirementsTxt)) {
         try {
             const content = readFileSync(requirementsTxt, 'utf-8');
-            if (content.toLowerCase().includes('fastapi')) {
-                return 'fastapi';
+            if (content.toLowerCase().includes(technologyValue('technology-fastapi-6aee0e'))) {
+                return technologyValue('technology-fastapi-6aee0e');
             }
         }
         catch {
@@ -150,8 +151,8 @@ export function detectArchitectureStack(projectPath) {
                         ? pkg.devDependencies
                         : {}),
                 };
-                if ('express' in deps) {
-                    return 'express';
+                if (technologyValue('technology-express-008231') in deps) {
+                    return technologyValue('technology-express-008231');
                 }
             }
         }

package/dist/engine/runtime-policy.d.ts

@@ -0,0 +1,9 @@
+import type { BoundedDurationPolicy, RuntimePolicy } from '../types/runtime-policy.js';
+/** Validate an in-memory policy fixture without mutating the process cache. */
+export declare function parseRuntimePolicyForTests(raw: unknown): RuntimePolicy;
+/** Load the validated bundled runtime authority once per process. */
+export declare function getRuntimePolicy(): RuntimePolicy;
+/** Resolve a numeric environment override without duplicating policy bounds. */
+export declare function boundedEnvironmentDuration(variableName: string, policy: BoundedDurationPolicy): number;
+export declare function resetRuntimePolicyCacheForTests(): void;
+//# sourceMappingURL=runtime-policy.d.ts.map

package/dist/engine/runtime-policy.js

@@ -0,0 +1,138 @@
+import { z } from 'zod';
+import { createRequire } from 'node:module';
+import { PROCESS_TERMINATION_GRACE_MS } from './abortable-process-runner.js';
+const boundedDurationSchema = z
+    .object({
+    defaultTimeoutMs: z.number().int().positive(),
+    minimumTimeoutMs: z.number().int().positive(),
+    maximumTimeoutMs: z.number().int().positive(),
+})
+    .strict()
+    .refine((value) => value.minimumTimeoutMs <= value.defaultTimeoutMs, {
+    message: 'minimumTimeoutMs must not exceed defaultTimeoutMs',
+})
+    .refine((value) => value.defaultTimeoutMs <= value.maximumTimeoutMs, {
+    message: 'defaultTimeoutMs must not exceed maximumTimeoutMs',
+});
+const runtimePolicySchema = z
+    .object({
+    acknowledgementBudgetMs: z.number().int().positive(),
+    toolExecution: boundedDurationSchema
+        .extend({
+        safetyMarginRatio: z.number().positive().max(1),
+        safetyMarginMaximumMs: z.number().int().positive(),
+    })
+        .strict(),
+    qualityAssurance: boundedDurationSchema
+        .extend({ maximumOutputBufferBytes: z.number().int().positive() })
+        .strict(),
+    lintValidation: boundedDurationSchema,
+    createSpec: z
+        .object({
+        criticalTimeoutMs: z.number().int().positive(),
+        inlineAnalysisBudgetMs: z.number().int().positive(),
+        idempotencyClaimStaleMs: z.number().int().positive(),
+        idempotencyClaimWaitMs: z.number().int().positive(),
+        idempotencyClaimPollMs: z.number().int().positive(),
+        idempotencyMatchWindowMs: z.number().int().positive(),
+    })
+        .strict()
+        .refine((value) => value.inlineAnalysisBudgetMs < value.criticalTimeoutMs, {
+        message: 'inlineAnalysisBudgetMs must be below criticalTimeoutMs',
+    })
+        .refine((value) => value.idempotencyClaimPollMs < value.idempotencyClaimWaitMs, {
+        message: 'idempotencyClaimPollMs must be below idempotencyClaimWaitMs',
+    }),
+    validation: z
+        .object({
+        defaultDeadlineMs: z.number().int().positive(),
+        durableLintTimeoutMs: z.number().int().positive(),
+        complianceCommandTimeoutMs: z.number().int().positive(),
+        noProgressTimeoutMs: z.number().int().positive(),
+        submissionLockWaitMs: z.number().int().positive(),
+        submissionLockPollMs: z.number().int().positive(),
+        workerLeaseMs: z.number().int().positive(),
+        workerHeartbeatMs: z.number().int().positive(),
+        workerConcurrency: z.number().int().positive(),
+        heartbeatStartupTimeoutMs: z.number().int().positive(),
+        heartbeatShutdownTimeoutMs: z.number().int().positive(),
+        heartbeatDatabaseBusyTimeoutMs: z.number().int().positive(),
+        freshnessLeaseTtlMs: z.number().int().positive(),
+        freshnessInvalidationCoalesceMs: z.number().int().positive(),
+        receiptPublicationDeadlineMs: z.number().int().positive(),
+        receiptCheckpointLogMaxBytes: z.number().int().positive(),
+        receiptCheckpointResultMaxBytes: z.number().int().positive(),
+    })
+        .strict()
+        .refine((value) => value.submissionLockPollMs < value.submissionLockWaitMs, {
+        message: 'submissionLockPollMs must be below submissionLockWaitMs',
+    })
+        .refine((value) => value.workerHeartbeatMs < value.workerLeaseMs, {
+        message: 'workerHeartbeatMs must be below workerLeaseMs',
+    })
+        .refine((value) => value.durableLintTimeoutMs < value.complianceCommandTimeoutMs, {
+        message: 'durableLintTimeoutMs must be below complianceCommandTimeoutMs',
+    })
+        .refine((value) => value.complianceCommandTimeoutMs + PROCESS_TERMINATION_GRACE_MS <
+        value.noProgressTimeoutMs, {
+        message: 'complianceCommandTimeoutMs plus termination grace must be below noProgressTimeoutMs',
+    })
+        .refine((value) => value.complianceCommandTimeoutMs < value.defaultDeadlineMs, {
+        message: 'complianceCommandTimeoutMs must be below defaultDeadlineMs',
+    })
+        .refine((value) => value.noProgressTimeoutMs < value.defaultDeadlineMs, {
+        message: 'noProgressTimeoutMs must be below defaultDeadlineMs',
+    })
+        .refine((value) => value.heartbeatDatabaseBusyTimeoutMs < value.workerLeaseMs - value.workerHeartbeatMs, { message: 'heartbeatDatabaseBusyTimeoutMs must fit within the worker lease' })
+        .refine((value) => value.freshnessInvalidationCoalesceMs < value.freshnessLeaseTtlMs, {
+        message: 'freshnessInvalidationCoalesceMs must be below freshnessLeaseTtlMs',
+    })
+        .refine((value) => value.receiptPublicationDeadlineMs <= value.workerLeaseMs - value.workerHeartbeatMs, { message: 'receiptPublicationDeadlineMs must fit within the worker lease' })
+        .refine((value) => value.receiptCheckpointLogMaxBytes <= value.receiptCheckpointResultMaxBytes, {
+        message: 'receiptCheckpointLogMaxBytes must not exceed receiptCheckpointResultMaxBytes',
+    }),
+    postCommit: z
+        .object({
+        defaultTaskTimeoutMs: z.number().int().positive(),
+        minimumLeaseMs: z.number().int().positive(),
+        leaseMultiplier: z.number().int().positive(),
+        maximumRememberedTransitions: z.number().int().positive(),
+        minimumHeartbeatMs: z.number().int().positive(),
+    })
+        .strict(),
+})
+    .strict();
+const require = createRequire(import.meta.url);
+let cachedPolicy;
+/** Validate an in-memory policy fixture without mutating the process cache. */
+export function parseRuntimePolicyForTests(raw) {
+    const parsed = runtimePolicySchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new Error(`Invalid bundled runtime-policy config: ${parsed.error.message}`);
+    }
+    return parsed.data;
+}
+/** Load the validated bundled runtime authority once per process. */
+export function getRuntimePolicy() {
+    if (cachedPolicy === undefined) {
+        const raw = require('../config/runtime-policy.json');
+        cachedPolicy = parseRuntimePolicyForTests(raw);
+    }
+    return cachedPolicy;
+}
+/** Resolve a numeric environment override without duplicating policy bounds. */
+export function boundedEnvironmentDuration(variableName, policy) {
+    const raw = process.env[variableName];
+    if (raw === undefined || raw.trim() === '') {
+        return policy.defaultTimeoutMs;
+    }
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isFinite(parsed)) {
+        return policy.defaultTimeoutMs;
+    }
+    return Math.min(policy.maximumTimeoutMs, Math.max(policy.minimumTimeoutMs, parsed));
+}
+export function resetRuntimePolicyCacheForTests() {
+    cachedPolicy = undefined;
+}
+//# sourceMappingURL=runtime-policy.js.map

package/dist/engine/runtime-security/checkers/content-security.js

@@ -1,11 +1,26 @@
-// engine/runtime-security/checkers/content-security.ts — SPEC-084 AC-12
-// Detects insecure code patterns and unsafe configurations in generated content.
+import { technologyValue } from '../../technology-registry.js';
 const INSECURE_CODE_PATTERNS = [
     // TypeScript/JavaScript
-    { name: 'eval', regex: /\beval\s*\(/g, language: 'typescript' },
-    { name: 'innerHTML', regex: /\.innerHTML\s*=/g, language: 'typescript' },
-    { name: 'dangerouslySetInnerHTML', regex: /dangerouslySetInnerHTML/g, language: 'typescript' },
-    { name: 'document.write', regex: /document\.write\s*\(/g, language: 'typescript' },
+    {
+        name: 'eval',
+        regex: /\beval\s*\(/g,
+        language: technologyValue('technology-typescript-969545'),
+    },
+    {
+        name: 'innerHTML',
+        regex: /\.innerHTML\s*=/g,
+        language: technologyValue('technology-typescript-969545'),
+    },
+    {
+        name: 'dangerouslySetInnerHTML',
+        regex: /dangerouslySetInnerHTML/g,
+        language: technologyValue('technology-typescript-969545'),
+    },
+    {
+        name: 'document.write',
+        regex: /document\.write\s*\(/g,
+        language: technologyValue('technology-typescript-969545'),
+    },
     // Python
     { name: 'pickle.loads', regex: /pickle\.loads?\s*\(/g, language: 'python' },
     { name: 'yaml.load-unsafe', regex: /yaml\.load\s*\([^)]*(?!Loader)/g, language: 'python' },

package/dist/engine/runtime-security/checkers/file-permissions.js

@@ -7,8 +7,6 @@ function getDefaultAllowedDirs(projectPath) {
     if (projectPath) {
         dirs.push(path.resolve(projectPath));
     }
-    // data/ directory relative to process.cwd()
-    dirs.push(path.resolve(process.cwd(), 'data'));
     return dirs;
 }
 function isPathAllowed(filePath, allowedDirs) {

package/dist/engine/runtime-security/rate-limiter.js

@@ -10,7 +10,6 @@ const READ_TOOLS = new Set([
     'estimate',
     'semantic_search',
     'list_groups',
-    'license_status',
     'usage_stats',
     'usage_report',
     'spec_history',

package/dist/engine/safety/atomic-write-file.js

@@ -7,6 +7,8 @@ import { dirname } from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { isSpecMdPath, isSpecFrozenByPath } from '../freeze/freeze-checker.js';
 import { hasUnlockToken, consumeUnlock } from '../freeze/unlock-token.js';
+import { assertExecutionCanCommit } from '../execution/context.js';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
 const IS_POSIX = process.platform !== 'win32';
 // ---------------------------------------------------------------------------
 // SPEC-747: Freeze-on-done error
@@ -95,6 +97,9 @@ export async function atomicWriteFile(targetPath, content, opts) {
         await tmpFd.datasync();
         await tmpFd.close();
         tmpFd = null;
+        // The temporary file is not externally visible. Cross the request commit
+        // fence immediately before the only externally visible mutation.
+        assertExecutionCanCommit();
         await rename(tmpPath, targetPath);
         if (fsyncParent) {
             await fsyncDirectory(dirname(targetPath));
@@ -106,16 +111,18 @@ export async function atomicWriteFile(targetPath, content, opts) {
             try {
                 await tmpFd.close();
             }
-            catch {
-                // ignore close error
+            catch (closeError) {
+                // reliability-cleanup: ATOMIC_TEMP_CLOSE — original write failure remains primary
+                reportClassifiedDegradation('ATOMIC_TEMP_CLOSE', closeError);
             }
         }
         // Best-effort cleanup of tmp file
         try {
             await unlink(tmpPath);
         }
-        catch {
-            // Ignore cleanup errors — tmp will be swept by cleanupOrphanTmps()
+        catch (cleanupError) {
+            // reliability-cleanup: ATOMIC_TEMP_UNLINK — startup scavenger removes orphan
+            reportClassifiedDegradation('ATOMIC_TEMP_UNLINK', cleanupError);
         }
         throw err;
     }
@@ -135,14 +142,17 @@ async function fsyncDirectory(dirPath) {
         await dirFd.close();
         dirFd = null;
     }
-    catch {
+    catch (error) {
+        // reliability-optional: DIRECTORY_FSYNC — target bytes are already durable
+        reportClassifiedDegradation('DIRECTORY_FSYNC', error);
         // Non-fatal — target file is already durable, only dir metadata may need recovery
         if (dirFd !== null) {
             try {
                 await dirFd.close();
             }
-            catch {
-                // ignore
+            catch (closeError) {
+                // reliability-cleanup: DIRECTORY_FD_CLOSE — no live mutation remains
+                reportClassifiedDegradation('DIRECTORY_FD_CLOSE', closeError);
             }
         }
     }
@@ -166,8 +176,9 @@ export async function cleanupOrphanTmps(dir) {
                 await unlink(full);
                 removed++;
             }
-            catch {
-                // ignore
+            catch (error) {
+                // reliability-cleanup: ORPHAN_TEMP_SWEEP — later sweep retries the orphan
+                reportClassifiedDegradation('ORPHAN_TEMP_SWEEP', error);
             }
         }
     }

package/dist/engine/safety/atomic-writer.js

@@ -2,6 +2,9 @@
 import { rename, copyFile, unlink, readFile, writeFile, mkdir } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { dirname } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { withFileLock } from '../../storage/file-mutex.js';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
 const DEFAULT_BACKUP_COUNT = 3;
 /**
  * Write JSON data atomically with backup rotation.
@@ -14,9 +17,12 @@ const DEFAULT_BACKUP_COUNT = 3;
  * On failure during steps 2-4, the `.tmp` file is cleaned up silently.
  */
 export async function writeJsonSafe(filePath, data, opts) {
+    return withFileLock(filePath, () => writeJsonSafeLocked(filePath, data, opts));
+}
+async function writeJsonSafeLocked(filePath, data, opts) {
     const backupCount = opts?.backupCount ?? DEFAULT_BACKUP_COUNT;
     const verify = opts?.verify ?? true;
-    const tmpPath = `${filePath}.tmp`;
+    const tmpPath = `${filePath}.tmp.${process.pid.toString()}.${randomBytes(4).toString('hex')}`;
     // Ensure parent directory exists
     await mkdir(dirname(filePath), { recursive: true });
     // Rotate backups if target already exists
@@ -42,8 +48,9 @@ export async function writeJsonSafe(filePath, data, opts) {
         try {
             await unlink(tmpPath);
         }
-        catch {
-            // Ignore cleanup errors
+        catch (cleanupError) {
+            // reliability-cleanup: JSON_TEMP_UNLINK — original write failure remains primary
+            reportClassifiedDegradation('JSON_TEMP_UNLINK', cleanupError);
         }
         throw err;
     }

package/dist/engine/safety/contained-project-file.d.ts

@@ -0,0 +1,3 @@
+/** Resolve a currently existing regular file whose physical path is contained by a project root. */
+export declare function resolveContainedProjectFile(projectPath: string, candidatePath: string): Promise<string>;
+//# sourceMappingURL=contained-project-file.d.ts.map

package/dist/engine/safety/contained-project-file.js

@@ -0,0 +1,23 @@
+import { lstat, realpath } from 'node:fs/promises';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+function isOutside(root, candidate) {
+    const pathFromRoot = relative(root, candidate);
+    return pathFromRoot === '..' || pathFromRoot.startsWith(`..${sep}`) || isAbsolute(pathFromRoot);
+}
+/** Resolve a currently existing regular file whose physical path is contained by a project root. */
+export async function resolveContainedProjectFile(projectPath, candidatePath) {
+    const lexicalRoot = resolve(projectPath);
+    const lexicalCandidate = resolve(candidatePath);
+    const [projectRealPath, candidateRealPath, candidateStatus] = await Promise.all([
+        realpath(lexicalRoot),
+        realpath(lexicalCandidate),
+        lstat(lexicalCandidate),
+    ]);
+    if (candidateStatus.isSymbolicLink() ||
+        !candidateStatus.isFile() ||
+        isOutside(projectRealPath, candidateRealPath)) {
+        throw new Error('CONTAINED_PROJECT_FILE_REJECTED: candidate is not a contained regular file');
+    }
+    return candidateRealPath;
+}
+//# sourceMappingURL=contained-project-file.js.map

package/dist/engine/safety/cross-process-lock.d.ts

@@ -1,52 +1,15 @@
-import type { CrossProcessLockMetadata, AcquireLockOptions, LockHandle, LockInfo } from '../../types/spec-lock-v2.js';
+import type { AcquireLockOptions, CrossProcessLockMetadata, LockHandle, LockInfo } from '../../types/spec-lock-v2.js';
 export { getLockScavengeMetrics, resetLockScavengeMetricsForTests, scavengeStaleLockArtifacts, } from './lock-scavenger.js';
 declare const HEARTBEAT_INTERVAL_MS = 30000;
 export { HEARTBEAT_INTERVAL_MS };
-/** Thrown by withSpecLock when the lock is held by another live session. */
 export declare class LockBusyError extends Error {
     readonly code: 'LOCK_BUSY';
     readonly holder: CrossProcessLockMetadata;
     constructor(holder: CrossProcessLockMetadata);
 }
-/**
- * Try to acquire a cross-process lock for `specId`.
- *
- * Returns a LockHandle on success, or null if the lock is held by another live session.
- * Stale locks (PID dead, heartbeat expired, or TTL expired) are reclaimed automatically.
- *
- * @remarks
- * NFS / SMB caveat: O_EXCL is not guaranteed atomic on network filesystems.
- * This implementation is reliable on local POSIX filesystems (APFS, HFS+, ext4, tmpfs).
- */
-export declare function acquireLock(projectPath: string, specId: string, opts?: AcquireLockOptions): Promise<LockHandle | null>;
-/**
- * Release a lock if it is still held by the given handle.
- * Idempotent: calling twice on the same handle is safe.
- * Will NOT unlink a lockfile that is now held by a different session.
- */
+export declare function acquireLock(projectPath: string, specId: string, options?: AcquireLockOptions): Promise<LockHandle | null>;
 export declare function releaseLock(handle: LockHandle): Promise<void>;
-/**
- * Read the current lockfile state for a spec.
- * Returns null when no lockfile exists.
- * Enriches the result with computed staleness fields.
- */
 export declare function isLocked(projectPath: string, specId: string): Promise<LockInfo | null>;
-/**
- * List all cross-process locks for a project, filtering out stale ones.
- * Non-existent `.locks/` directory returns an empty array.
- */
 export declare function listActiveCrossProcessLocks(projectPath: string): Promise<LockInfo[]>;
-/**
- * High-level wrapper: acquire → run fn → release.
- * Automatically sets up a 30s heartbeat and tears it down on completion.
- * Throws LockBusyError if the lock cannot be acquired.
- *
- * @example
- * ```ts
- * await withSpecLock(projectPath, specId, async (_handle) => {
- *   await mutatSpec();
- * }, { reason: 'update_status(approved)' });
- * ```
- */
-export declare function withSpecLock<T>(projectPath: string, specId: string, fn: (handle: LockHandle) => Promise<T>, opts?: AcquireLockOptions): Promise<T>;
+export declare function withSpecLock<T>(projectPath: string, specId: string, fn: (handle: LockHandle) => Promise<T>, options?: AcquireLockOptions): Promise<T>;
 //# sourceMappingURL=cross-process-lock.d.ts.map