@planu/cli 4.4.1 → 4.4.3

package/dist/engine/skill-registry/skill-security-scanner.js

@@ -0,0 +1,87 @@
+// engine/skill-registry/skill-security-scanner.ts — SPEC-1081
+// Optional SkillSpector adapter for scanning external AI agent skills.
+import { execFile } from 'node:child_process';
+const SCANNER = 'skillspector';
+const COMMAND = 'skillspector scan <skillDir> --no-llm --format json';
+export class SkillSecurityScannerUnavailableError extends Error {
+    constructor(skillName, cause) {
+        const detail = cause instanceof Error ? cause.message : String(cause);
+        super(`Skill security scanner unavailable for "${skillName}". Command: ${COMMAND}. ${detail}`);
+        this.name = 'SkillSecurityScannerUnavailableError';
+    }
+}
+function normalizeSeverity(value) {
+    if (value === 'LOW' || value === 'MEDIUM' || value === 'HIGH' || value === 'CRITICAL') {
+        return value;
+    }
+    return 'UNKNOWN';
+}
+function normalizeRecommendation(value) {
+    if (value === 'SAFE' || value === 'CAUTION' || value === 'DO_NOT_INSTALL') {
+        return value;
+    }
+    return 'UNKNOWN';
+}
+function normalizeScore(value) {
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+        return 100;
+    }
+    return Math.max(0, Math.min(100, value));
+}
+function parseReport(stdout, skillName) {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch (err) {
+        throw new SkillSecurityScannerUnavailableError(skillName, err);
+    }
+    const risk = parsed.risk_assessment ?? {};
+    const version = parsed.metadata?.skillspector_version;
+    return {
+        scanner: SCANNER,
+        scannerVersion: typeof version === 'string' ? version : undefined,
+        scannedAt: new Date().toISOString(),
+        score: normalizeScore(risk.score),
+        severity: normalizeSeverity(risk.severity),
+        recommendation: normalizeRecommendation(risk.recommendation),
+        issuesCount: Array.isArray(parsed.issues) ? parsed.issues.length : 0,
+        command: COMMAND,
+        available: true,
+    };
+}
+function runSkillSpector(skillDir) {
+    return new Promise((resolve, reject) => {
+        execFile(SCANNER, ['scan', skillDir, '--no-llm', '--format', 'json'], (err, stdout) => {
+            if (err) {
+                const error = err instanceof Error ? err : new Error('Unknown execFile error');
+                reject(Object.assign(error, { stdout }));
+                return;
+            }
+            resolve(stdout);
+        });
+    });
+}
+/**
+ * Scan a prepared skill directory using SkillSpector static analysis only.
+ *
+ * SkillSpector returns exit code 1 for high-risk reports. Planu still parses stdout
+ * in that case because the report is valid and should drive the gate decision.
+ */
+export async function scanSkillSecurity(skillDir, skillName) {
+    try {
+        const stdout = await runSkillSpector(skillDir);
+        return parseReport(stdout, skillName);
+    }
+    catch (err) {
+        if (typeof err === 'object' &&
+            err !== null &&
+            'stdout' in err &&
+            typeof err.stdout === 'string' &&
+            err.stdout.trim().length > 0) {
+            return parseReport(err.stdout, skillName);
+        }
+        throw new SkillSecurityScannerUnavailableError(skillName, err);
+    }
+}
+//# sourceMappingURL=skill-security-scanner.js.map

package/dist/engine/spec-format/bdd-parser.js

@@ -83,6 +83,15 @@ export function renderBddScenariosYaml(scenarios) {
     for (const scenario of scenarios) {
         lines.push(`  - title: "${escapeYaml(scenario.title)}"`);
         lines.push(`    done: ${String(scenario.done)}`);
+        if (scenario.tests && scenario.tests.length > 0) {
+            lines.push(`    tests:`);
+            for (const test of scenario.tests) {
+                lines.push(`      - path: ${test.path}`);
+                if (test.line !== undefined) {
+                    lines.push(`        line: ${String(test.line)}`);
+                }
+            }
+        }
         lines.push(`    steps:`);
         for (const step of scenario.steps) {
             lines.push(`      - keyword: ${step.keyword}`);

package/dist/engine/spec-format/lean-spec-generator.js

@@ -55,7 +55,7 @@ export function generateLeanSpecContent(input) {
     ];
     let acLines;
     if (acFormat === 'bdd') {
-        acLines = buildBddLines(description, extraCriteria, input.criteriaOverride);
+        acLines = buildBddLines(description, extraCriteria, input.criteriaOverride, input.scenarioTestPaths ?? []);
     }
     else {
         acLines = buildCheckboxLines(description, extraCriteria, input.criteriaOverride);
@@ -88,7 +88,7 @@ function buildCheckboxLines(description, extraCriteria, criteriaOverride) {
     ];
 }
 /** Build BDD scenario lines. */
-function buildBddLines(description, extraCriteria, criteriaOverride) {
+function buildBddLines(description, extraCriteria, criteriaOverride, scenarioTestPaths) {
     let scenarios = parseBddScenarios(description);
     // Fallback: convert checkbox criteria to BDD scenarios
     if (scenarios.length === 0) {
@@ -108,6 +108,14 @@ function buildBddLines(description, extraCriteria, criteriaOverride) {
             });
         }
     }
+    if (scenarioTestPaths.length > 0) {
+        scenarios = scenarios.map((scenario) => ({
+            ...scenario,
+            tests: scenario.tests && scenario.tests.length > 0
+                ? scenario.tests
+                : scenarioTestPaths.map((path) => ({ path })),
+        }));
+    }
     return renderBddScenariosYaml(scenarios);
 }
 /** Extract acceptance criteria from description. Looks for checkbox patterns or generates a default.

package/dist/engine/spec-migrator/planu-canonical-policy.js

@@ -4,7 +4,7 @@ export const PLANU_CANONICAL_POLICY = {
     canonicalRootFiles: ['conventions.json', 'context.md', 'session-context.md', 'session.json'],
     canonicalRootDirs: ['releases', 'specs'],
     canonicalSpecFiles: ['spec.md'],
-    canonicalSpecDirs: ['evidence'],
+    canonicalSpecDirs: [],
     forbiddenHostAssetRootDirs: ['agents', 'skills', 'rules', 'hooks'],
     generatedRuntimePatterns: [
         'planu/index.html',
@@ -71,8 +71,8 @@ export function canonicalContractText() {
         '  specs/',
         '    SPEC-XXX-slug/',
         '      spec.md',
-        '      evidence/',
-        '        *.json',
+        '',
+        'Evidence artifacts are Planu runtime data and are stored outside planu/specs/.',
         '',
         'Host adapters are written outside planu/:',
         '  Claude Code: .claude/agents, .claude/skills, .claude/rules',

package/dist/engine/universal-rules/rules/planu-workflow.js

@@ -28,7 +28,7 @@ For non-trivial specs, Planu blocks lifecycle transitions unless evidence is pre
 | done | Traceability matrix covering every acceptance criterion |
 | done for API/UI/event/MCP work | Passing contract validation evidence |
 
-Evidence can live under \`planu/specs/<spec>/evidence/\` or the external Planu handoff store. Trivial specs may use lightweight evidence, but \`done\` still needs at least one traceability row.
+Evidence lives in the external Planu handoff store, not under \`planu/specs/<spec>/\`. Spec folders remain \`spec.md\`-only. Trivial specs may use lightweight evidence, but \`done\` still needs at least one traceability row.
 
 ## When to use \`facilitate\`
 

package/dist/tools/challenge-spec/implementation-contract-challenge-scenarios.d.ts

@@ -0,0 +1,3 @@
+import type { FailureScenario, Spec } from '../../types/index.js';
+export declare function generateImplementationContractChallengeScenarios(spec: Spec, specContent: string): FailureScenario[];
+//# sourceMappingURL=implementation-contract-challenge-scenarios.d.ts.map

package/dist/tools/challenge-spec/implementation-contract-challenge-scenarios.js

@@ -0,0 +1,51 @@
+import { evaluateImplementationContract } from '../../engine/implementation-contract/index.js';
+import { parseFrontmatterScenarios } from '../../engine/validator/spec-compliance-runner.js';
+export function generateImplementationContractChallengeScenarios(spec, specContent) {
+    const criteria = parseFrontmatterScenarios(specContent).map((scenario) => scenario.title);
+    const issues = evaluateImplementationContract(stripFrontmatter(specContent), criteria);
+    if (issues.length === 0) {
+        return [];
+    }
+    const missingEdges = !/\b(edge cases?|failure modes?)\b/i.test(specContent);
+    const missingBoundaries = !/\b(no-touch|forbidden|non-goals?|out of scope)\b/i.test(specContent);
+    const scenarios = [];
+    scenarios.push({
+        scenario: `[${spec.id}] Implementation Contract Gap: spec leaves the implementer to infer required behavior, file scope, verification, or missing decisions.`,
+        probability: 'high',
+        impact: 'high',
+        currentHandling: issues
+            .map((issue) => issue.message)
+            .slice(0, 3)
+            .join('; '),
+        requiredHandling: 'Add or repair ## Implementation Contract before coding: user outcome, behavior contract, file-level work plan, acceptance-to-verification map, edge cases, non-goals, and verification commands.',
+        dataConsistency: 'Do not start implementation until the spec states what persistent files or state may change.',
+        userExperience: 'The planner should ask for concrete missing decisions instead of sending an ambiguous spec to the implementer.',
+    });
+    if (missingEdges) {
+        scenarios.push({
+            scenario: `[${spec.id}] Missing Edge Cases: implementation may pass happy-path criteria while failing required failure modes.`,
+            probability: 'medium',
+            impact: 'high',
+            currentHandling: 'Edge cases and failure modes are not explicit in the spec.',
+            requiredHandling: 'Add concrete edge cases and failure modes to ## Implementation Contract before approval.',
+            dataConsistency: 'State-changing behavior must define rollback or no-write behavior for failures.',
+            userExperience: 'Users should not discover undefined behavior during implementation review.',
+        });
+    }
+    if (missingBoundaries) {
+        scenarios.push({
+            scenario: `[${spec.id}] Missing No-Touch Boundaries: implementer may refactor unrelated code or satisfy the wording with an architecture-violating shortcut.`,
+            probability: 'medium',
+            impact: 'high',
+            currentHandling: 'No non-goals, forbidden approaches, or no-touch areas are explicit.',
+            requiredHandling: 'Add non-goals, forbidden approaches, and no-touch areas to the implementation contract.',
+            dataConsistency: 'Unrelated persistent formats and stores must not change without explicit scope.',
+            userExperience: 'The implementer receives bounded work instead of open-ended refactoring permission.',
+        });
+    }
+    return scenarios;
+}
+function stripFrontmatter(raw) {
+    return raw.replace(/^---\n[\s\S]*?\n---\n?/, '');
+}
+//# sourceMappingURL=implementation-contract-challenge-scenarios.js.map

package/dist/tools/challenge-spec.js

@@ -14,6 +14,7 @@ import { prioritizeScenarios, buildPrioritizedSummary } from '../engine/challeng
 import { checkContradictions as checkScopeContradictions } from '../engine/scope-boundaries/index.js';
 import { buildChallengeSpecSummary } from '../engine/human-summary.js';
 import { generateAgentChallengeScenarios, isAgentSpec, } from './challenge-spec/agent-challenge-scenarios.js';
+import { generateImplementationContractChallengeScenarios } from './challenge-spec/implementation-contract-challenge-scenarios.js';
 import { getPlatformChallenges } from './challenge-spec/platform-challenge-scenarios.js';
 import { generateSecurityChallengeScenarios } from './challenge-spec/security-challenge-scenarios.js';
 import { generatePrivacyChallengeScenarios } from './challenge-spec/privacy-challenge-scenarios.js';
@@ -150,6 +151,9 @@ export async function handleChallengeSpec(args, server) {
     if (isAgentSpec(spec, specContent)) {
         failureScenarios.push(...generateAgentChallengeScenarios(spec, specContent, knowledge));
     }
+    if (focusAreas.includes('failures')) {
+        failureScenarios.push(...generateImplementationContractChallengeScenarios(spec, specContent));
+    }
     // 5h. SPEC-015a: Smart contract, bot, and IoT challenges
     failureScenarios.push(...getPlatformChallenges(spec, specContent, knowledge));
     // 5i. SPEC-029: Security authorization and STRIDE challenges

package/dist/tools/create-spec.js

@@ -20,6 +20,7 @@ import { extractCriteria, generateLeanSpecContent, } from '../engine/spec-format
 import { generateLeanTechnicalContent, } from '../engine/spec-format/lean-technical-generator.js';
 import { extractFilesFromSpecBody } from '../engine/spec-format/technical-md-populator.js';
 import { buildUnifiedSpecContent } from '../engine/spec-format/unified-spec-builder.js';
+import { appendImplementationContractIfMissing } from '../engine/implementation-contract/index.js';
 import { validateEnglishOnlySpecText } from '../engine/spec-language/english-only.js';
 import { ApiKeyResolver, FallbackGenerator, OpusGenerator, } from '../engine/spec-generator/index.js';
 import { analyzeProjectForSpec, getEmptyAutopilotResult, } from './create-spec/autopilot-analyzer.js';
@@ -666,6 +667,8 @@ export async function handleCreateSpec(inputParams, server) {
                     userInput: description,
                     autopilot,
                 }));
+                const outOfScopeResolved = resolveOutOfScope(description, params.outOfScope);
+                const scenarioTestPaths = groundedTechnical.files.test.map((file) => file.path);
                 const leanSpec = generateLeanSpecContent({
                     spec,
                     description: generatedSpec.specBody,
@@ -677,6 +680,7 @@ export async function handleCreateSpec(inputParams, server) {
                     groundingCriteria,
                     groundingTechnicalReferences: groundedTechnical.records,
                     acFormat: params.acFormat,
+                    scenarioTestPaths,
                 });
                 const leanTechnical = generateLeanTechnicalContent({
                     specId: spec.id,
@@ -687,7 +691,21 @@ export async function handleCreateSpec(inputParams, server) {
                 // SPEC-709: write unified spec.md from origin — no separate technical.md.
                 // The legacy two-file output is preserved by appending the technical body
                 // as a `## Technical` section inside spec.md.
-                const unifiedSpec = buildUnifiedSpecContent(leanSpec, leanTechnical);
+                const unifiedWithoutContract = buildUnifiedSpecContent(leanSpec, leanTechnical);
+                const unifiedSpec = appendImplementationContractIfMissing(unifiedWithoutContract, {
+                    description: generatedSpec.specBody,
+                    criteria: contractCriteria.map((record) => ({ text: record.text, done: false })),
+                    files: groundedTechnical.files,
+                    outOfScope: outOfScopeResolved.items,
+                    verificationCommands: [
+                        ...(scenarioTestPaths.length > 0
+                            ? [`pnpm vitest run ${scenarioTestPaths.join(' ')}`]
+                            : []),
+                        'pnpm typecheck',
+                        'pnpm lint',
+                        'pnpm test',
+                    ],
+                });
                 const genericOutputGate = checkGenericSpecOutput(unifiedSpec);
                 if (!genericOutputGate.passed) {
                     return {
@@ -725,7 +743,6 @@ export async function handleCreateSpec(inputParams, server) {
                     throw writeErr;
                 }
                 // SPEC-612: Auto-suggest outOfScope when user did not provide any
-                const outOfScopeResolved = resolveOutOfScope(description, params.outOfScope);
                 if (outOfScopeResolved.items.length > 0) {
                     spec.outOfScope = outOfScopeResolved.items;
                 }

package/dist/tools/skill-registry/install.js

@@ -36,6 +36,15 @@ export async function handleSkillInstall(params) {
         if (result.version) {
             lines.push(`Version: ${result.version}`);
         }
+        if (result.securityScan) {
+            lines.push('');
+            if (result.securityScan.available) {
+                lines.push(`Security scan: ${result.securityScan.severity} (${result.securityScan.recommendation}) — score ${String(result.securityScan.score)}/100`);
+            }
+            else {
+                lines.push(`Security scan: unavailable (${result.securityScan.recommendation})`);
+            }
+        }
         if (splitInfo.splitApplied) {
             lines.push('');
             lines.push(`Note: Skill was split into ${String(splitInfo.referenceFiles.length + 1)} files for context efficiency (progressive disclosure).`);

package/dist/tools/update-status/evidence-gate.js

@@ -80,7 +80,7 @@ function evidenceGateError(args) {
                     transition: args.transition,
                     issues: args.issues,
                     requiredContractKinds: args.requiredContractKinds,
-                    fixHint: 'Add the missing evidence artifact under planu/specs/<spec>/evidence/ or external Planu project data handoffs/<specId>/, then retry the transition.',
+                    fixHint: 'Add the missing evidence artifact to the external Planu project data handoff store, then retry the transition. Do not create JSON files under planu/specs/<spec>/.',
                 }, null, 2),
             },
         ],
@@ -95,7 +95,7 @@ function evidenceGateError(args) {
                 issues: args.issues,
                 requiredContractKinds: args.requiredContractKinds,
             },
-            fixHint: 'Add discovery.json, task-plan.json, traceability-matrix.json, and contract-validation-*.json as required for this transition.',
+            fixHint: 'Add discovery.json, task-plan.json, traceability-matrix.json, and contract-validation-*.json to the external Planu handoff store as required for this transition. Spec folders remain spec.md-only.',
         },
     };
 }

package/dist/types/skill-registry.d.ts

@@ -69,6 +69,63 @@ export interface SkillInstallResult {
     hasScripts: boolean;
     /** Installed version, if available. */
     version?: string;
+    /** Security scan summary for this install, when the skill source was scanned. */
+    securityScan?: SkillSecurityScanResult;
+}
+/** Severity labels returned by the skill security scanner. */
+export type SkillSecuritySeverity = 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' | 'UNKNOWN';
+/** Recommendation labels returned by the skill security scanner. */
+export type SkillSecurityRecommendation = 'SAFE' | 'CAUTION' | 'DO_NOT_INSTALL' | 'UNKNOWN';
+/** Policy to use when the external skill security scanner cannot run. */
+export type SkillSecurityScannerUnavailablePolicy = 'fail-closed' | 'allow';
+/** Options controlling skill security scanning during installation. */
+export interface SkillInstallOptions {
+    /** Policy for scanner execution failures. Defaults to fail-closed for external skills. */
+    scannerUnavailablePolicy?: SkillSecurityScannerUnavailablePolicy;
+}
+/** In-memory skill content prepared before writing to host skill directories. */
+export interface PreparedSkillInstallContent {
+    /** SKILL.md content to write or scan. */
+    content: string;
+    /** Whether the source skill advertises executable script files. */
+    hasScripts: boolean;
+    /** Installed version, if available. */
+    version?: string;
+}
+/** Normalized security scan summary persisted by Planu. */
+export interface SkillSecurityScanResult {
+    /** Scanner name. */
+    scanner: 'skillspector';
+    /** Scanner version, if reported by the scanner. */
+    scannerVersion?: string;
+    /** ISO 8601 timestamp when Planu ran or recorded the scan. */
+    scannedAt: string;
+    /** Numeric risk score, 0-100. */
+    score: number;
+    /** Risk severity label. */
+    severity: SkillSecuritySeverity;
+    /** Scanner recommendation. */
+    recommendation: SkillSecurityRecommendation;
+    /** Number of findings/issues reported by the scanner. */
+    issuesCount: number;
+    /** Exact scanner command shape used, without secrets or environment values. */
+    command: string;
+    /** Whether the scanner completed successfully. */
+    available: boolean;
+    /** Optional failure reason when available=false. */
+    error?: string;
+}
+/** Minimal JSON shape emitted by SkillSpector in --format json mode. */
+export interface SkillSpectorJsonReport {
+    risk_assessment?: {
+        score?: unknown;
+        severity?: unknown;
+        recommendation?: unknown;
+    };
+    issues?: unknown[];
+    metadata?: {
+        skillspector_version?: unknown;
+    };
 }
 /** Manifest tracking all skills installed in a project. */
 export interface SkillManifest {
@@ -95,6 +152,8 @@ export interface InstalledSkillEntry {
     sourceStatus?: 'active' | 'source-unavailable';
     /** Absolute path to the installed skill directory. */
     path: string;
+    /** Security scan summary captured during installation, when available. */
+    securityScan?: SkillSecurityScanResult;
 }
 /** SPEC-668: Result of a skills TTL refresh operation. */
 export interface SkillTTLRefreshResult {

package/dist/types/spec-format.d.ts

@@ -22,6 +22,10 @@ export interface BddScenario {
     title: string;
     steps: BddStep[];
     done: boolean;
+    tests?: {
+        path: string;
+        line?: number;
+    }[];
 }
 /** Input for lean spec generation. */
 export interface LeanSpecInput {
@@ -38,6 +42,8 @@ export interface LeanSpecInput {
     groundingTechnicalReferences?: TechnicalReferenceGroundingRecord[];
     /** SPEC-481: Acceptance criteria format. Defaults to 'checkbox'. */
     acFormat?: 'checkbox' | 'bdd';
+    /** SPEC-1082: Test links to attach to generated BDD scenarios when available. */
+    scenarioTestPaths?: string[];
 }
 /** A file entry in the unified spec.md Technical section. */
 export interface LeanFileEntry {
@@ -121,4 +127,19 @@ export interface LeanTechnicalInput {
     filesToModify?: LeanFileEntry[];
     filesToTest?: LeanFileEntry[];
 }
+export interface ImplementationContractInput {
+    description: string;
+    criteria: LeanCriterion[];
+    files: {
+        create: LeanFileEntry[];
+        modify: LeanFileEntry[];
+        test: LeanFileEntry[];
+    };
+    outOfScope: string[];
+    verificationCommands: string[];
+}
+export interface ImplementationContractIssue {
+    code: 'contract_missing' | 'contract_subsection_missing' | 'contract_subsection_empty' | 'contract_filler' | 'contract_needs_decision' | 'contract_unmapped_criterion' | 'contract_manual_verification_vague';
+    message: string;
+}
 //# sourceMappingURL=spec-format.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "4.4.1",
+  "version": "4.4.3",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -34,14 +34,14 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "4.4.1",
-    "@planu/core-darwin-x64": "4.4.1",
-    "@planu/core-linux-arm64-gnu": "4.4.1",
-    "@planu/core-linux-arm64-musl": "4.4.1",
-    "@planu/core-linux-x64-gnu": "4.4.1",
-    "@planu/core-linux-x64-musl": "4.4.1",
-    "@planu/core-win32-arm64-msvc": "4.4.1",
-    "@planu/core-win32-x64-msvc": "4.4.1"
+    "@planu/core-darwin-arm64": "4.4.3",
+    "@planu/core-darwin-x64": "4.4.3",
+    "@planu/core-linux-arm64-gnu": "4.4.3",
+    "@planu/core-linux-arm64-musl": "4.4.3",
+    "@planu/core-linux-x64-gnu": "4.4.3",
+    "@planu/core-linux-x64-musl": "4.4.3",
+    "@planu/core-win32-arm64-msvc": "4.4.3",
+    "@planu/core-win32-x64-msvc": "4.4.3"
   },
   "engines": {
     "node": ">=24.0.0"
@@ -129,7 +129,7 @@
   ],
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.100.1",
+    "@anthropic-ai/sdk": "^0.104.1",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "glob": "^13.0.6",
     "yaml": "^2.9.0",
@@ -181,8 +181,8 @@
     "@semantic-release/release-notes-generator": "^14.1.1",
     "@stryker-mutator/core": "^9.6.1",
     "@stryker-mutator/vitest-runner": "^9.6.1",
-    "@supabase/supabase-js": "^2.107.0",
-    "@types/node": "^25.9.1",
+    "@supabase/supabase-js": "^2.108.1",
+    "@types/node": "^25.9.2",
     "@vitejs/plugin-vue": "^6.0.7",
     "@vitest/coverage-v8": "^4.1.8",
     "@vue/test-utils": "^2.4.11",
@@ -190,19 +190,19 @@
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-import": "^2.32.0",
-    "happy-dom": "^20.10.1",
+    "happy-dom": "^20.10.2",
     "husky": "^9.1.7",
     "javascript-obfuscator": "^5.4.3",
-    "knip": "^6.15.0",
+    "knip": "^6.16.1",
     "lint-staged": "^17.0.7",
     "madge": "^8.0.0",
-    "prettier": "^3.8.3",
+    "prettier": "^3.8.4",
     "secretlint": "^13.0.2",
     "semantic-release": "^25.0.3",
     "tsc-alias": "^1.8.17",
     "type-coverage": "^2.29.7",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.60.1",
+    "typescript-eslint": "^8.61.0",
     "vite": "^8.0.16",
     "vitest": "^4.1.8",
     "vue": "^3.5.35"

package/planu-native.json

@@ -1,26 +1,20 @@
 {
   "name": "dev.planu.native",
   "displayName": "Planu Native Lightweight Surface",
-  "version": "4.4.1",
+  "version": "4.4.3",
   "packageName": "@planu/cli",
   "modes": {
     "lightweight": {
       "requiresMcp": false,
       "requiresDaemon": false,
-      "hosts": [
-        "codex",
-        "claude-code"
-      ],
+      "hosts": ["codex", "claude-code"],
       "commands": [
         {
           "id": "planu.status",
           "title": "Project status",
           "description": "Show the compact Planu project snapshot without loading the MCP tool graph.",
           "invocation": "planu status",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handlePlanStatus"
@@ -30,10 +24,7 @@
           "title": "Create spec",
           "description": "Create a new spec through the CLI-backed SDD contract.",
           "invocation": "planu spec create \"<title>\"",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleCreateSpec"
@@ -43,10 +34,7 @@
           "title": "List specs",
           "description": "List specs in the current project with optional status/type filters.",
           "invocation": "planu spec list",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleListSpecs"
@@ -56,10 +44,7 @@
           "title": "Validate spec",
           "description": "Validate a spec against the current codebase from the native CLI surface.",
           "invocation": "planu spec validate SPEC-001",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleValidate"
@@ -69,10 +54,7 @@
           "title": "Audit technical debt",
           "description": "Run the read-only project audit path for lightweight debt checks.",
           "invocation": "planu audit debt",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleAudit"
@@ -82,10 +64,7 @@
           "title": "Check release readiness",
           "description": "Check local branch cleanliness and main/develop/release sync readiness.",
           "invocation": "planu release check",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "releaseCommand"