@planu/cli 4.3.0 → 4.3.2

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## [4.3.2] - 2026-05-22
+
+**Tarball SHA-256:** `7732de964d5e10d24bdab5ea79baee3d281654cf5caff1f713671502c8e09ee3`
+
+### Bug Fixes
+- fix(security): enforce moderate vulnerability gate
+
+
 ## [4.3.0] - 2026-05-22
 
 **Tarball SHA-256:** `ebc3e7fe0a284d6ba6062dfb9aab41fe6e9396a7763c6d39764d676d20a0b6c3`

package/dist/engine/spec-generator/fallback-generator.js

@@ -1,34 +1,16 @@
-const MAX_SUMMARY_LENGTH = 700;
 export class FallbackGenerator {
     generate(request) {
-        const slug = slugify(request.title);
-        const pascalName = toPascalCase(request.title);
-        const sourceSummary = normalizeSummary(request.description, request.title);
+        const sourceDescription = normalizeSourceDescription(request.description, request.title);
         const contextLine = buildContextLine(request);
-        const technicalSection = buildTechnicalSection(slug, pascalName, contextLine);
+        const technicalSection = buildTechnicalSection(contextLine);
         const specBody = [
             '## Problem',
-            sourceSummary,
+            sourceDescription,
             '',
             '## Solution',
-            `Implement ${request.title} with explicit behavior, project-scoped file ownership, and verification gates. ${contextLine}`,
-            '',
-            '## Acceptance Criteria',
-            '',
-            `Scenario: ${request.title} happy path`,
-            'GIVEN the relevant user or system context exists',
-            `WHEN the requested ${request.title} behavior is executed`,
-            'THEN the expected outcome from the request is observable',
-            '',
-            `Scenario: ${request.title} failure handling`,
-            'GIVEN invalid input or an unavailable dependency',
-            `WHEN the requested ${request.title} behavior runs`,
-            'THEN the system returns a clear failure state without corrupting data',
-            '',
-            `Scenario: ${request.title} verification`,
-            'GIVEN the implementation is complete',
-            'WHEN the configured verification commands run',
-            'THEN tests and lint pass without regressions',
+            'Use the preserved source description above as the authoritative requirements body. ' +
+                'Do not infer implementation ownership beyond details explicitly provided in the source. ' +
+                contextLine,
             '',
             technicalSection,
         ].join('\n');
@@ -38,25 +20,18 @@ export class FallbackGenerator {
             generatedWithModel: 'deterministic-fallback',
             generatedAt: new Date().toISOString(),
             qualityWarnings: [
-                'Fallback generator used. Review candidate file paths and replace placeholders with exact code owners before approval.',
+                'Fallback generator used. Source description was preserved; no implementation files, type signatures, or ownership were inferred.',
             ],
             fallbackReason: 'No external model generator is configured for create_spec.',
         });
     }
 }
-function normalizeSummary(description, title) {
-    const compact = description
-        .replace(/\r\n/g, '\n')
-        .split('\n')
-        .map((line) => line.trim())
-        .filter((line) => line.length > 0 && !line.startsWith('- [ ]'))
-        .join(' ')
-        .replace(/\s+/g, ' ')
-        .trim();
-    const summary = compact.length > 0
-        ? compact.slice(0, MAX_SUMMARY_LENGTH)
-        : `The project needs ${title} defined with enough implementation detail to proceed safely.`;
-    return summary.endsWith('.') ? summary : `${summary}.`;
+function normalizeSourceDescription(description, title) {
+    const compact = description.replace(/\r\n/g, '\n').trim();
+    if (compact.length > 0) {
+        return compact;
+    }
+    return `The project needs ${title} defined with enough implementation detail to proceed safely.`;
 }
 function buildContextLine(request) {
     const parts = [
@@ -69,34 +44,22 @@ function buildContextLine(request) {
     }
     return `Use the existing ${parts.join(' / ')} project conventions.`;
 }
-function buildTechnicalSection(slug, pascalName, contextLine) {
+function buildTechnicalSection(contextLine) {
     return [
         '## Technical',
         '',
         '### Implementation Notes',
         `- ${contextLine}`,
-        '- Replace candidate paths with exact files before moving the spec to approved.',
+        '- Preserve the source requirements as the contract until a reviewer or agent adds exact implementation ownership.',
         '',
         '## Files',
         '',
         '### Create',
-        `- src/${slug}.ts (candidate path; replace with exact owner during planning)`,
+        '- _Not specified in source description._',
         '### Modify',
-        '- src/index.ts (candidate integration point; replace with exact owner during planning)',
+        '- _Not specified in source description._',
         '### Test',
-        `- tests/${slug}.test.ts (focused coverage for the behavior and failure path)`,
-        '',
-        '## Type Signatures',
-        '```typescript',
-        `interface ${pascalName}Input {`,
-        '  readonly requestId?: string;',
-        '}',
-        '',
-        `interface ${pascalName}Result {`,
-        '  readonly ok: boolean;',
-        '  readonly reason?: string;',
-        '}',
-        '```',
+        '- _Not specified in source description._',
         '',
         '## Verification',
         '- pnpm typecheck',
@@ -104,17 +67,4 @@ function buildTechnicalSection(slug, pascalName, contextLine) {
         '- pnpm test',
     ].join('\n');
 }
-function slugify(input) {
-    const slug = input
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, '-')
-        .replace(/^-+|-+$/g, '');
-    return slug.length > 0 ? slug : 'generated-spec';
-}
-function toPascalCase(input) {
-    const words = input.match(/[a-zA-Z0-9]+/g) ?? ['Generated', 'Spec'];
-    return words
-        .map((word) => `${word.charAt(0).toUpperCase()}${word.slice(1).toLowerCase()}`)
-        .join('');
-}
 //# sourceMappingURL=fallback-generator.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "4.3.0",
+  "version": "4.3.2",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -32,14 +32,14 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "4.3.0",
-    "@planu/core-darwin-x64": "4.3.0",
-    "@planu/core-linux-arm64-gnu": "4.3.0",
-    "@planu/core-linux-arm64-musl": "4.3.0",
-    "@planu/core-linux-x64-gnu": "4.3.0",
-    "@planu/core-linux-x64-musl": "4.3.0",
-    "@planu/core-win32-arm64-msvc": "4.3.0",
-    "@planu/core-win32-x64-msvc": "4.3.0"
+    "@planu/core-darwin-arm64": "4.3.2",
+    "@planu/core-darwin-x64": "4.3.2",
+    "@planu/core-linux-arm64-gnu": "4.3.2",
+    "@planu/core-linux-arm64-musl": "4.3.2",
+    "@planu/core-linux-x64-gnu": "4.3.2",
+    "@planu/core-linux-x64-musl": "4.3.2",
+    "@planu/core-win32-arm64-msvc": "4.3.2",
+    "@planu/core-win32-x64-msvc": "4.3.2"
   },
   "engines": {
     "node": ">=24.0.0"
@@ -144,7 +144,8 @@
       "lodash-es": ">=4.18.0",
       "hono": ">=4.12.14",
       "postcss": ">=8.5.10",
-      "fast-uri": ">=3.1.2"
+      "fast-uri": ">=3.1.2",
+      "qs": ">=6.15.2"
     },
     "supportedArchitectures": {
       "os": [