@planu/cli 4.13.0 → 5.0.0

package/dist/tools/register-platform-tools/lifecycle-infra-tools.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { t } from '../../i18n/index.js';
-import { safeTracked, safeLicensed } from '../safe-handler.js';
+import { safeTracked, safeGoverned } from '../safe-handler.js';
 import { DocumentationTypeEnum, GitActionEnum, DevLifecycleCategoryEnum, PMPlatformEnum, PMActionEnum, OrchestrateActionEnum, ManageContextActionEnum, ContextBudgetActionEnum, SpecIdSchema, } from '../schemas/index.js';
 import { handleSuggestTooling } from '../suggest-tooling.js';
 import { handleGenerateTests } from '../generate-tests.js';
@@ -27,7 +27,7 @@ export function registerLifecycleInfraTools(server) {
                 .optional()
                 .describe('Specific categories to assess'),
         },
-    }, safeLicensed('suggest_tooling', async (args) => handleSuggestTooling(args)));
+    }, safeGoverned('suggest_tooling', async (args) => handleSuggestTooling(args)));
     // 32. generate_tests
     server.registerTool('generate_tests', {
         description: t('tools.generate_tests.description'),
@@ -80,7 +80,7 @@ export function registerLifecycleInfraTools(server) {
                 .describe('Content to save (required for save action)'),
             ttlDays: z.number().optional().describe('Time-to-live in days (optional for save)'),
         },
-    }, safeLicensed('manage_context', async (args) => handleManageContext(args)));
+    }, safeGoverned('manage_context', async (args) => handleManageContext(args)));
     // 35. manage_git
     server.registerTool('manage_git', {
         description: t('tools.manage_git.description'),
@@ -154,7 +154,7 @@ export function registerLifecycleInfraTools(server) {
             eventType: z.string().max(500).optional().describe('Journal event type for emit action'),
             commitHash: z.string().max(500).optional().describe('Commit hash to record in journal'),
         },
-    }, safeLicensed('orchestrate', async (args) => handleOrchestrate(args)));
+    }, safeGoverned('orchestrate', async (args) => handleOrchestrate(args)));
     // 37. integrate_pm
     server.registerTool('integrate_pm', {
         description: t('tools.integrate_pm.description'),
@@ -169,7 +169,7 @@ export function registerLifecycleInfraTools(server) {
                 .optional()
                 .describe('Platform-specific configuration'),
         },
-    }, safeLicensed('integrate_pm', async (args) => handleIntegratePM(args)));
+    }, safeGoverned('integrate_pm', async (args) => handleIntegratePM(args)));
     // 38. paradigm_report
     server.registerTool('paradigm_report', {
         description: t('tools.paradigm_report.description'),
@@ -177,7 +177,7 @@ export function registerLifecycleInfraTools(server) {
             projectId: z.string().max(500).describe('Project ID to analyse for paradigms'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('paradigm_report', async (args) => handleParadigmReport(args)));
+    }, safeGoverned('paradigm_report', async (args) => handleParadigmReport(args)));
     // 39. context_budget
     server.registerTool('context_budget', {
         description: t('tools.context_budget.description'),
@@ -232,6 +232,6 @@ export function registerLifecycleInfraTools(server) {
                 .optional()
                 .describe('Pending work items'),
         },
-    }, safeLicensed('context_budget', async (args) => handleContextBudget(args)));
+    }, safeGoverned('context_budget', async (args) => handleContextBudget(args)));
 }
 //# sourceMappingURL=lifecycle-infra-tools.js.map

package/dist/tools/register-sdd-tools.d.ts

@@ -1,4 +1,4 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare const OFFICIAL_SDD_TOOL_NAMES: readonly ['planu_status', 'facilitate', 'init_project', 'clarify_requirements', 'create_spec', 'challenge_spec', 'check_readiness', 'update_status', 'update_status_batch', 'package_handoff', 'validate', 'reconcile_spec', 'create_rule', 'create_skill', 'skill_search', 'configure_code_graph', 'code_graph_status', 'submit_feedback', 'triage_feedback', 'resolve_feedback', 'sync_feedback', 'feedback_status'];
+export { OFFICIAL_SDD_TOOL_NAMES } from './tool-registry/inventory.js';
 export declare function registerSddTools(server: McpServer): void;
 //# sourceMappingURL=register-sdd-tools.d.ts.map

package/dist/tools/register-sdd-tools.js

@@ -12,30 +12,8 @@ import { handleCreateRule } from './create-rule.js';
 import { handleCreateSkill } from './create-skill.js';
 import { handleReconcileUniversalRules } from './reconcile-universal-rules.js';
 import { registerPrompts } from '../prompts/index.js';
-export const OFFICIAL_SDD_TOOL_NAMES = [
-    'planu_status',
-    'facilitate',
-    'init_project',
-    'clarify_requirements',
-    'create_spec',
-    'challenge_spec',
-    'check_readiness',
-    'update_status',
-    'update_status_batch',
-    'package_handoff',
-    'validate',
-    'reconcile_spec',
-    'create_rule',
-    'create_skill',
-    'skill_search',
-    'configure_code_graph',
-    'code_graph_status',
-    'submit_feedback',
-    'triage_feedback',
-    'resolve_feedback',
-    'sync_feedback',
-    'feedback_status',
-];
+import { OFFICIAL_SDD_TOOL_NAMES } from './tool-registry/inventory.js';
+export { OFFICIAL_SDD_TOOL_NAMES } from './tool-registry/inventory.js';
 const OFFICIAL_SDD_TOOL_SET = new Set(OFFICIAL_SDD_TOOL_NAMES);
 const noop = () => undefined;
 const DUMMY_TOOL_SLOT = {

package/dist/tools/register-spec-tools/analysis-tools.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { t } from '../../i18n/index.js';
-import { safeTracked, safeLicensed } from '../safe-handler.js';
+import { safeTracked, safeGoverned } from '../safe-handler.js';
 import { ChecklistFocusEnum, AuditCategoryEnum, SpecIdSchema } from '../schemas/index.js';
 import { resolveProjectId, missingProjectIdError } from '../resolve-project-id.js';
 import { handleDetectDrift } from '../detect-drift.js';
@@ -92,7 +92,7 @@ export function registerAnalysisTools(server) {
                 .optional()
                 .describe('Focus areas for the checklist'),
         },
-    }, safeLicensed('generate_checklist', async (args) => {
+    }, safeGoverned('generate_checklist', async (args) => {
         const pid = resolveProjectId(args);
         if (!pid) {
             return missingProjectIdError;
@@ -130,7 +130,7 @@ export function registerAnalysisTools(server) {
                 .optional()
                 .describe('Manual changes to apply'),
         },
-    }, safeLicensed('reconcile_spec', async (args) => {
+    }, safeGoverned('reconcile_spec', async (args) => {
         const pid = resolveProjectId(args);
         if (!pid) {
             return missingProjectIdError;
@@ -178,7 +178,7 @@ export function registerAnalysisTools(server) {
                 .describe('Audit categories to check'),
             specId: SpecIdSchema.optional().describe('Spec ID to audit against'),
         },
-    }, safeLicensed('audit', async (args) => {
+    }, safeGoverned('audit', async (args) => {
         const pid = resolveProjectId(args);
         if (!pid) {
             return missingProjectIdError;
@@ -220,7 +220,7 @@ export function registerAnalysisTools(server) {
                 .describe('Path to MCP config file (auto-detected if omitted)'),
             projectId: z.string().max(500).optional().describe('Project ID'),
         },
-    }, safeLicensed('discover_mcps', async (args) => handleDiscoverMcps(args)));
+    }, safeGoverned('discover_mcps', async (args) => handleDiscoverMcps(args)));
     // 19. suggest_mcps
     server.registerTool('suggest_mcps', {
         description: t('tools.suggest_mcps.description'),
@@ -233,7 +233,7 @@ export function registerAnalysisTools(server) {
                 .describe('Absolute path to project root. Derives projectId automatically.'),
             specId: SpecIdSchema.optional().describe('Spec ID for context-specific suggestions'),
         },
-    }, safeLicensed('suggest_mcps', async (args) => {
+    }, safeGoverned('suggest_mcps', async (args) => {
         const pid = resolveProjectId(args);
         if (!pid) {
             return missingProjectIdError;
@@ -252,7 +252,7 @@ export function registerAnalysisTools(server) {
                 .optional()
                 .describe('Absolute path to project root. Derives projectId automatically.'),
         },
-    }, safeLicensed('suggest_mcp_server', async (args) => {
+    }, safeGoverned('suggest_mcp_server', async (args) => {
         const pid = resolveProjectId(args);
         if (!pid) {
             return missingProjectIdError;
@@ -321,6 +321,6 @@ export function registerAnalysisTools(server) {
                 .describe('When false (default), done-status specs are skipped (respects SPEC-747 freeze). ' +
                 'Set true to migrate done specs (writes backup to planu/backups/ first).'),
         },
-    }, safeLicensed('ssr_back_migration', async (args) => handleSsrBackMigration(args)));
+    }, safeGoverned('ssr_back_migration', async (args) => handleSsrBackMigration(args)));
 }
 //# sourceMappingURL=analysis-tools.js.map

package/dist/tools/register-spec-tools/core-spec-tools.js

@@ -1,7 +1,8 @@
 import { z } from 'zod';
 import { t } from '../../i18n/index.js';
-import { safeTracked, safeLicensed } from '../safe-handler.js';
-import { SupportedLocaleEnum, SpecStatusEnum, SpecTypeEnum, SpecScopeEnum, SpecTargetEnum, ExperienceLevelEnum, WorkModeEnum, ListSpecsOutputSchema, EstimateOutputSchema, ValidateOutputSchema, SpecIdSchema, } from '../schemas/index.js';
+import { safeTracked, safeGoverned } from '../safe-handler.js';
+import { SupportedLocaleEnum, SpecStatusEnum, ExperienceLevelEnum, WorkModeEnum, ListSpecsOutputSchema, EstimateOutputSchema, ValidateOutputSchema, SpecIdSchema, } from '../schemas/index.js';
+import { SpecAcFormatEnum, SpecScopeEnum, SpecTargetEnum, SpecTypeEnum } from '../schemas/spec.js';
 import { handleSetLocale } from '../set-locale.js';
 import { handleInitProject } from '../init-project.js';
 import { handleSetWorkMode } from '../set-work-mode-handler.js';
@@ -15,6 +16,7 @@ import { handleEstimate } from '../estimate.js';
 import { handleReverseEngineer } from '../reverse-engineer.js';
 import { handleValidate } from '../validate.js';
 import { handleTypeSafetyGate } from '../type-safety-gate.js';
+import { runWithTrustedLocalMcpContext } from '../../engine/lifecycle-reconciliation.js';
 /** init_project inputSchema — extracted to keep registerCoreSpecTools within line budget. */
 const INIT_PROJECT_INPUT_SCHEMA = {
     projectPath: z.string().max(4096).describe('Absolute path to the project root'),
@@ -57,6 +59,11 @@ const INIT_PROJECT_INPUT_SCHEMA = {
         .boolean()
         .optional()
         .describe('Auto-install recommended skills into .claude/skills/ during init (default: true). Set to false to only list recommendations without installing.'),
+    authorizedMigrations: z
+        .array(z.literal('planu-spec-format-v1'))
+        .max(1)
+        .optional()
+        .describe('Explicit named authorization for repository-content migration during an update. Omit for a byte-identical safe update.'),
     workMode: WorkModeEnum.optional().describe('Preferred interaction style: guided (step-by-step hints for SDD newcomers) | standard (normal workflow, default) | expert (concise output, no onboarding hints). Ask the user before running init_project.'),
     clarificationAnswers: z
         .record(z.string(), z.string())
@@ -189,6 +196,14 @@ export function registerCoreSpecTools(server) {
                 .describe('Detailed description of the feature or change. ' +
                 'Max 10000 chars. For larger specs, create with a summary description (<3k chars) ' +
                 'and append the rest via reconcile_spec post-creation.'),
+            idempotencyKey: z
+                .string()
+                .trim()
+                .min(8)
+                .max(128)
+                .regex(/^[A-Za-z0-9._:-]+$/)
+                .optional()
+                .describe('Stable caller key. Retries return the exact committed create_spec result.'),
             projectPath: z
                 .string()
                 .max(4096)
@@ -203,10 +218,7 @@ export function registerCoreSpecTools(server) {
                 .max(500)
                 .optional()
                 .describe('Feature group tag (e.g. "Authentication", "Billing"). Added to tags for categorization. Flat structure — no subdirectories created.'),
-            acFormat: z
-                .enum(['bdd', 'checkbox'])
-                .optional()
-                .describe('SPEC-224: Format for acceptance criteria in spec.md. ' +
+            acFormat: SpecAcFormatEnum.optional().describe('SPEC-224: Format for acceptance criteria in spec.md. ' +
                 'checkbox (default) — markdown checkboxes (- [ ] criterion). ' +
                 'bdd — Gherkin Given-When-Then scenarios for BDD workflows.'),
             clarificationAnswers: z
@@ -278,6 +290,13 @@ export function registerCoreSpecTools(server) {
                 'Omitting this field when a pending token exists returns isError: true.'),
         },
         outputSchema: ListSpecsOutputSchema,
+        annotations: {
+            title: 'List Specs',
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
     }, safeTracked('list_specs', async (args) => handleListSpecs(args)));
     // 7. update_status
     server.registerTool('update_status', {
@@ -379,12 +398,22 @@ export function registerCoreSpecTools(server) {
                 .max(2000)
                 .optional()
                 .describe('SPEC-733: Required for reverse transitions (done→implementing, discarded→draft). Must be ≥30 chars explaining why the spec is being reopened.'),
+            reconciliationRequestId: z
+                .string()
+                .regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u)
+                .optional()
+                .describe('Trusted local MCP only: lowercase UUID idempotency key for implementing to review reconciliation.'),
+            expectedImplementingTransitionId: z.string().max(500).optional(),
+            implementationReviewDigest: z
+                .string()
+                .regex(/^sha256:[a-f0-9]{64}$/u)
+                .optional(),
             forceApprove: z
                 .boolean()
                 .optional()
                 .describe('SPEC-769: Force-approve a spec that scored below 70 on the readiness gate. Warnings are stored in spec.md frontmatter. Use when the LLM has explicitly confirmed the spec is ready despite a low readiness score.'),
         },
-    }, safeTracked('update_status', async (args) => handleUpdateStatus(args)));
+    }, safeTracked('update_status', async (args) => runWithTrustedLocalMcpContext(() => handleUpdateStatus(args))));
     server.registerTool('update_status_batch', {
         description: 'Batch update many specs to the same status in one MCP execution. Uses the same transition rules as update_status and reports updated/skipped/failed per spec.',
         inputSchema: {
@@ -424,12 +453,16 @@ export function registerCoreSpecTools(server) {
                 .optional()
                 .describe('Analysis depth: shallow (fast scan), deep (full file scan), deep-v2 (full scan + test coverage, dependency graph, API detection, complexity metrics, config analysis). Default: shallow'),
         },
-    }, safeLicensed('reverse_engineer', async (args) => handleReverseEngineer(args)));
+    }, safeGoverned('reverse_engineer', async (args) => handleReverseEngineer(args)));
     // 10. validate
     server.registerTool('validate', {
         description: t('tools.validate.description'),
         inputSchema: {
             specId: SpecIdSchema.describe('Spec ID to validate'),
+            mode: z
+                .literal('submit')
+                .default('submit')
+                .describe('Persist validation as a durable background job.'),
             projectId: z
                 .string()
                 .max(500)
@@ -442,6 +475,13 @@ export function registerCoreSpecTools(server) {
                 .describe('Absolute path to project root. Derives projectId automatically — always correct even after context compaction.'),
         },
         outputSchema: ValidateOutputSchema,
+        annotations: {
+            title: 'Submit Durable Validation',
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
     }, safeTracked('validate', async (args) => handleValidate(args)));
     // 10b. type_safety_gate — SPEC-968
     server.registerTool('type_safety_gate', {

package/dist/tools/registry/auth.js

@@ -2,13 +2,16 @@
 // tools/registry/auth.ts — AC-8: Authentication handlers for registry
 import { readFile, writeFile, mkdir, unlink, chmod } from 'node:fs/promises';
 import { join } from 'node:path';
-import { homedir } from 'node:os';
 import { compactResult } from '../output-formatter.js';
+import { resolveStorageLayout } from '../../storage/storage-layout.js';
+import { deleteSecretField, storeSecretField } from '../../security/secret-field.js';
+import { parseSecretReference } from '../../security/secret-provider.js';
+import { redactText } from '../../security/redactor.js';
 /** 30-day expiry in milliseconds */
 const TOKEN_EXPIRY_MS = 30 * 24 * 60 * 60 * 1000;
 /** Path to the credentials file. */
 function credentialsPath() {
-    return join(homedir(), '.planu', 'credentials.json');
+    return join(resolveStorageLayout().secrets, 'registry-credentials.json');
 }
 /**
  * Handle registry_login tool invocation.
@@ -31,14 +34,15 @@ export async function handleRegistryLogin(args) {
             };
         }
         const credentials = {
-            token,
+            token: await storeSecretField('global/registry/pat', 'registry-pat', token),
             user,
             email,
             plan,
             expiresAt: expiresAt ?? new Date(Date.now() + TOKEN_EXPIRY_MS).toISOString(),
         };
         const credPath = credentialsPath();
-        await mkdir(join(homedir(), '.planu'), { recursive: true });
+        await mkdir(resolveStorageLayout().secrets, { recursive: true, mode: 0o700 });
+        await chmod(resolveStorageLayout().secrets, 0o700);
         await writeFile(credPath, JSON.stringify(credentials, null, 2), 'utf-8');
         await chmod(credPath, 0o600);
         return compactResult([
@@ -50,7 +54,7 @@ export async function handleRegistryLogin(args) {
     }
     catch (error) {
         /* v8 ignore start -- unexpected runtime errors */
-        const message = error instanceof Error ? error.message : String(error);
+        const message = redactText(error instanceof Error ? error.message : String(error));
         return {
             content: [{ type: 'text', text: `Registry login failed: ${message}` }],
             isError: true,
@@ -64,6 +68,9 @@ export async function handleRegistryLogin(args) {
  */
 export async function handleRegistryLogout(_args) {
     try {
+        const raw = await readFile(credentialsPath(), 'utf-8');
+        const credentials = JSON.parse(raw);
+        await deleteSecretField(credentials.token);
         await unlink(credentialsPath());
         return compactResult('Done: Logged out successfully');
         /* v8 ignore start -- error branches tested via unit mocks */
@@ -88,6 +95,7 @@ export async function handleRegistryWhoami(_args) {
     try {
         const raw = await readFile(credentialsPath(), 'utf-8');
         const cred = JSON.parse(raw);
+        parseSecretReference(cred.token);
         const isExpired = new Date(cred.expiresAt) <= new Date();
         const info = {
             user: cred.user,

package/dist/tools/registry/publish.js

@@ -1,14 +1,17 @@
 // tools/registry/publish.ts — AC-7: Publish a spec to the registry
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { homedir } from 'node:os';
 import { compactResult } from '../output-formatter.js';
+import { resolveStorageLayout } from '../../storage/storage-layout.js';
+import { resolveSecretField } from '../../security/secret-field.js';
+import { redactText } from '../../security/redactor.js';
 /** Load stored credentials or return null if not authenticated. */
 async function loadCredentials() {
     try {
-        const credPath = join(homedir(), '.planu', 'credentials.json');
+        const credPath = join(resolveStorageLayout().secrets, 'registry-credentials.json');
         const raw = await readFile(credPath, 'utf-8');
-        return JSON.parse(raw);
+        const credentials = JSON.parse(raw);
+        return { ...credentials, token: await resolveSecretField(credentials.token) };
     }
     catch {
         return null;
@@ -96,7 +99,7 @@ export async function handleRegistryPublish(args) {
     }
     catch (error) {
         /* v8 ignore start -- unexpected runtime errors */
-        const message = error instanceof Error ? error.message : String(error);
+        const message = redactText(error instanceof Error ? error.message : String(error));
         return {
             content: [{ type: 'text', text: `Registry publish failed: ${message}` }],
             isError: true,

package/dist/tools/resolve-project-path.d.ts

@@ -1,10 +1,10 @@
 import type { ProjectAutoDetectResult } from '../types/index.js';
 /**
  * SPEC-509: Detect the git repository root from the current working directory.
- * Runs `git rev-parse --show-toplevel` synchronously (non-blocking, fast).
+ * Runs `git rev-parse --show-toplevel` through the request process supervisor.
  * Returns the git root path or null when not inside a git repo.
  */
-export declare function detectGitRoot(): string | null;
+export declare function detectGitRoot(): Promise<string | null>;
 /**
  * Attempt to resolve a projectId + projectPath from the provided inputs.
  *

package/dist/tools/resolve-project-path.js

@@ -10,25 +10,25 @@
 //
 // This module is intentionally side-effect-free: it reads the global registry
 // and the env var but never mutates any state.
-import { spawnSync } from 'node:child_process';
 import { stat } from 'node:fs/promises';
 import { join } from 'node:path';
 import { hashProjectPath } from '../storage/base-store.js';
 import { getProjects } from '../storage/global-projects-store.js';
+import { runAbortableProcess } from '../engine/abortable-process-runner.js';
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
 /**
  * SPEC-509: Detect the git repository root from the current working directory.
- * Runs `git rev-parse --show-toplevel` synchronously (non-blocking, fast).
+ * Runs `git rev-parse --show-toplevel` through the request process supervisor.
  * Returns the git root path or null when not inside a git repo.
  */
-export function detectGitRoot() {
+export async function detectGitRoot() {
     try {
-        const result = spawnSync('git', ['rev-parse', '--show-toplevel'], {
+        const result = await runAbortableProcess('git', ['rev-parse', '--show-toplevel'], {
             cwd: process.cwd(),
-            encoding: 'utf-8',
-            timeout: 3000,
+            timeoutMs: 3_000,
+            maxBufferBytes: 1024 * 1024,
         });
         if (result.status === 0 && result.stdout) {
             return result.stdout.trim() || null;
@@ -131,7 +131,7 @@ export async function resolveProjectPath(params) {
         };
     }
     // 4. SPEC-509: git rev-parse --show-toplevel — detect from current working directory
-    const gitRoot = detectGitRoot();
+    const gitRoot = await detectGitRoot();
     if (gitRoot && (await hasPlanuDir(gitRoot))) {
         return {
             kind: 'resolved',

package/dist/tools/reverse-engineer/analyzer.js

@@ -1,7 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-// tools/reverse-engineer/analyzer.ts — Code structure analysis utilities
-// SPEC-027: Language-specific import patterns for framework terminology detection
+import { technologyValue } from '../../engine/technology-registry.js';
 export const CODE_EXTENSIONS = new Set([
     '.ts',
     '.tsx',
@@ -68,9 +65,9 @@ const LANGUAGE_STRATEGIES = {
  */
 export function detectLanguageFromExtension(ext) {
     const map = {
-        '.ts': 'typescript',
-        '.tsx': 'typescript',
-        '.mts': 'typescript',
+        '.ts': technologyValue('technology-typescript-969545'),
+        '.tsx': technologyValue('technology-typescript-969545'),
+        '.mts': technologyValue('technology-typescript-969545'),
         '.js': 'javascript',
         '.jsx': 'javascript',
         '.mjs': 'javascript',
@@ -98,14 +95,14 @@ export function detectLanguageFromExtension(ext) {
 export function getFrameworkTerminology(language, dependencies) {
     const depsLower = dependencies.map((d) => d.toLowerCase());
     // Next.js / React
-    if (depsLower.some((d) => d.includes('next') || d.includes('react'))) {
+    if (depsLower.some((d) => d.includes('next') || d.includes(technologyValue('technology-react-275976')))) {
         return 'Component / Hook / Provider / Server Action';
     }
     // Django / Flask
-    if (depsLower.some((d) => d.includes('django'))) {
+    if (depsLower.some((d) => d.includes(technologyValue('technology-django-7d8a08')))) {
         return 'View / Model / Serializer / Form / Middleware';
     }
-    if (depsLower.some((d) => d.includes('flask'))) {
+    if (depsLower.some((d) => d.includes(technologyValue('technology-flask-b87aa5')))) {
         return 'Blueprint / Route / Model / Schema';
     }
     // Spring Boot
@@ -113,19 +110,22 @@ export function getFrameworkTerminology(language, dependencies) {
         return 'Controller / Service / Repository / Entity / Bean';
     }
     // NestJS
-    if (depsLower.some((d) => d.includes('nestjs') || d.includes('@nestjs'))) {
+    if (depsLower.some((d) => d.includes(technologyValue('technology-nestjs-2d0087')) || d.includes('@nestjs'))) {
         return 'Module / Controller / Service / Guard / Interceptor';
     }
     // Laravel
-    if (depsLower.some((d) => d.includes('laravel'))) {
+    if (depsLower.some((d) => d.includes(technologyValue('technology-laravel-c34cfa')))) {
         return 'Controller / Model / Request / Resource / Policy';
     }
     // Rails
-    if (depsLower.some((d) => d.includes('rails') || d.includes('activerecord'))) {
+    if (depsLower.some((d) => d.includes(technologyValue('technology-rails-2e1d59')) ||
+        d.includes(technologyValue('technology-activerecord-97a448')))) {
         return 'Controller / Model / View / Concern / Job';
     }
     // Go frameworks
-    if (depsLower.some((d) => d.includes('gin') || d.includes('echo') || d.includes('fiber'))) {
+    if (depsLower.some((d) => d.includes(technologyValue('technology-gin-985adc')) ||
+        d.includes(technologyValue('technology-echo-092c79')) ||
+        d.includes(technologyValue('technology-fiber-77c3e6')))) {
         return 'Handler / Middleware / Service / Repository';
     }
     // Fallback by language

package/dist/tools/rollback-release.js

@@ -3,6 +3,7 @@ import { runRollback } from '../engine/release/rollback-runner.js';
 import { writePostmortem } from '../engine/release/postmortem-generator.js';
 import { appendTransitionEvent } from '../storage/transition-log.js';
 import { formatKeyValue } from './output-formatter.js';
+import { PLANU_VERSION } from '../config/version.js';
 // ---------------------------------------------------------------------------
 // Age guard (30 days)
 // ---------------------------------------------------------------------------
@@ -47,7 +48,7 @@ async function getPublishDate(packageName, version) {
 async function runVerificationSmokeTest(version) {
     const { spawn } = await import('node:child_process');
     return new Promise((resolve) => {
-        const child = spawn('npx', ['--yes', '@planu/cli@latest', '--version'], {
+        const child = spawn('npx', ['--yes', `@planu/cli@${PLANU_VERSION}`, '--version'], {
             stdio: ['ignore', 'pipe', 'pipe'],
         });
         let output = '';
@@ -180,7 +181,7 @@ export async function handleRollbackRelease(input) {
     }
     if (smokeTest && !smokeTest.ok) {
         additionalHints.push('rollback_smoke_failed — npm cache may still serve old tarball. ' +
-            'Users can run: npm cache clean --force && npx --ignore-existing @planu/cli@latest');
+            `Users can run: npm cache clean --force && npx --yes @planu/cli@${PLANU_VERSION} --version`);
     }
     return {
         content: [

package/dist/tools/safe-handler.d.ts

@@ -30,27 +30,19 @@ export declare function withToolTimeout<T>(p: Promise<T>, ms: number, fallback:
  * graceful MCP error response, preventing server crashes. Also enforces a
  * configurable execution timeout (default 55s, env PLANU_TOOL_TIMEOUT_MS).
  *
- * Usage — only for alwaysAllowed tools (activate_license, license_status, etc.):
+ * Usage — for infrastructure tools that do not need usage recording:
  *   server.registerTool('my_tool', schema, safe(async (args) => { ... }));
  */
 export declare function safe<T>(handler: (args: T, extra?: unknown) => Promise<ToolResult>): (args: T, extra?: unknown) => Promise<ToolResult>;
 /**
- * Composable wrapper: usage tracking + error boundary.
- * Use for free-tier tools that need rate limiting and usage recording.
+ * Composable wrapper: neutral local usage tracking + error boundary.
  *
  * Usage:
- *   server.registerTool('free_tool', schema, safeTracked('free_tool', async (args) => { ... }));
+ *   server.registerTool('tracked_tool', schema, safeTracked('tracked_tool', async (args) => { ... }));
  */
 export declare function safeTracked<T>(toolName: string, handler: (args: T, extra?: unknown) => Promise<ToolResult>): (args: T, extra?: unknown) => Promise<ToolResult>;
 /**
- * Composable wrapper: usage tracking + license gate + error boundary.
- * Use for tools that require a paid plan.
- *
- * Trial bypass: if the 30-day free trial is active, skips the license gate
- * entirely and routes to safeTracked (usage tracking without restriction).
- *
- * Usage:
- *   server.registerTool('pro_tool', schema, safeLicensed('pro_tool', async (args) => { ... }));
+ * Neutral governed wrapper: engineering budget + local usage + error boundary.
  */
-export declare function safeLicensed<T>(toolName: string, handler: (args: T, extra?: unknown) => Promise<ToolResult>): (args: T, extra?: unknown) => Promise<ToolResult>;
+export declare function safeGoverned<T>(toolName: string, handler: (args: T, extra?: unknown) => Promise<ToolResult>): (args: T, extra?: unknown) => Promise<ToolResult>;
 //# sourceMappingURL=safe-handler.d.ts.map