@planu/cli 5.0.0 → 5.2.0

package/dist/types/vector-store.d.ts

@@ -21,6 +21,24 @@ export interface TFIDFConfig {
     minDocFrequency: number;
     stopWords: Set<string>;
 }
+/** Serializable TF-IDF engine state (SPEC-1345: persisted index). */
+export interface TFIDFExportedState {
+    schemaVersion: number;
+    docFreq: [string, number][];
+    docCount: number;
+}
+/** A single corpus document as seen by the persisted semantic index (SPEC-1345). */
+export interface SemanticIndexDoc {
+    id: string;
+    content: string;
+}
+/** On-disk shape of a persisted TF-IDF index + hash manifest (SPEC-1345). */
+export interface PersistedSemanticIndex {
+    schemaVersion: number;
+    docHashes: Record<string, string>;
+    docTokens: Record<string, string[]>;
+    tfidfState: TFIDFExportedState;
+}
 /** Configuration for the HNSW index. */
 export interface HNSWConfig {
     M: number;

package/dist/types/workers.d.ts

@@ -8,7 +8,6 @@ export interface WorkerTrigger {
     /** Interval in ms for schedule triggers */
     intervalMs?: number;
 }
-export type WorkerTier = 'free' | 'pro';
 export interface WorkerDefinition {
     name: string;
     description: string;
@@ -19,7 +18,6 @@ export interface WorkerDefinition {
     /** Minimum ms between executions */
     cooldownMs: number;
     enabled: boolean;
-    tier: WorkerTier;
 }
 export type WorkerFindingSeverity = 'critical' | 'high' | 'medium' | 'low' | 'warning' | 'info';
 export interface WorkerFinding {
@@ -66,7 +64,6 @@ export interface WorkerOverride {
     enabled?: boolean;
     cooldownMs?: number;
     priority?: number;
-    tier?: WorkerTier;
 }
 export interface WorkerProjectConfig {
     overrides: Record<string, WorkerConfigOverride>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "5.0.0",
+  "version": "5.2.0",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -35,14 +35,14 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "5.0.0",
-    "@planu/core-darwin-x64": "5.0.0",
-    "@planu/core-linux-arm64-gnu": "5.0.0",
-    "@planu/core-linux-arm64-musl": "5.0.0",
-    "@planu/core-linux-x64-gnu": "5.0.0",
-    "@planu/core-linux-x64-musl": "5.0.0",
-    "@planu/core-win32-arm64-msvc": "5.0.0",
-    "@planu/core-win32-x64-msvc": "5.0.0"
+    "@planu/core-darwin-arm64": "5.2.0",
+    "@planu/core-darwin-x64": "5.2.0",
+    "@planu/core-linux-arm64-gnu": "5.2.0",
+    "@planu/core-linux-arm64-musl": "5.2.0",
+    "@planu/core-linux-x64-gnu": "5.2.0",
+    "@planu/core-linux-x64-musl": "5.2.0",
+    "@planu/core-win32-arm64-msvc": "5.2.0",
+    "@planu/core-win32-x64-msvc": "5.2.0"
   },
   "engines": {
     "node": ">=24.0.0"
@@ -77,6 +77,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage --testTimeout=60000 --maxWorkers=4",
+    "test:release-gate": "vitest run --exclude 'tests/integration/**'",
     "test:integration": "vitest run tests/integration",
     "test:website:unit": "vitest run tests/website tests/scripts/generate-website-proof.test.ts tests/scripts/website-tool-counts.test.ts",
     "test:website:browser": "playwright test --config playwright.website.config.ts",
@@ -117,7 +118,7 @@
     "prepublishOnly": "bash scripts/prepublish-guard.sh",
     "prepack": "pnpm build:ts && pnpm package:size",
     "test:debug": "vitest run --inspect-brk --single-thread",
-    "validate": "pnpm build && pnpm typecheck && pnpm verify:typescript-migration && pnpm lint && pnpm format:check && pnpm test",
+    "validate": "pnpm build && pnpm typecheck && pnpm verify:typescript-migration && pnpm lint && pnpm format:check && pnpm test:release-gate",
     "docker:build": "docker build -t planu .",
     "docker:run": "docker compose up",
     "publish:blog": "node scripts/publish-blog.mjs",

package/planu-native.json

@@ -1,26 +1,20 @@
 {
   "name": "dev.planu.native",
   "displayName": "Planu Native Lightweight Surface",
-  "version": "5.0.0",
+  "version": "5.2.0",
   "packageName": "@planu/cli",
   "modes": {
     "lightweight": {
       "requiresMcp": false,
       "requiresDaemon": false,
-      "hosts": [
-        "codex",
-        "claude-code"
-      ],
+      "hosts": ["codex", "claude-code"],
       "commands": [
         {
           "id": "planu.status",
           "title": "Project status",
           "description": "Show the compact Planu project snapshot without loading the MCP tool graph.",
           "invocation": "planu status",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handlePlanStatus"
@@ -30,10 +24,7 @@
           "title": "Create spec",
           "description": "Create a new spec through the CLI-backed SDD contract.",
           "invocation": "planu spec create \"<title>\"",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleCreateSpec"
@@ -43,10 +34,7 @@
           "title": "List specs",
           "description": "List specs in the current project with optional status/type filters.",
           "invocation": "planu spec list",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleListSpecs"
@@ -56,10 +44,7 @@
           "title": "Validate spec",
           "description": "Validate a spec against the current codebase from the native CLI surface.",
           "invocation": "planu spec validate SPEC-001",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleValidate"
@@ -69,10 +54,7 @@
           "title": "Audit technical debt",
           "description": "Run the read-only project audit path for lightweight debt checks.",
           "invocation": "planu audit debt",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleAudit"
@@ -82,10 +64,7 @@
           "title": "Check release readiness",
           "description": "Check local-first release readiness, branch cleanliness, and optional gitflow drift.",
           "invocation": "planu release check",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "releaseCommand"

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "5.0.0",
+  "version": "5.2.0",
   "icon": "assets/plugin/icon.svg",
   "command": ["npx", "@planu/cli@latest"],
   "packageName": "@planu/cli",

package/dist/engine/security/cve-refresher.d.ts

@@ -1,12 +0,0 @@
-import type { StalenessInfo } from '../../types/security/index.js';
-export type { StalenessInfo };
-export declare const CVE_DB_PATH: string;
-/** Check if known-cves.json is older than 7 days. */
-export declare function isCveDatabaseStale(): Promise<StalenessInfo>;
-/**
- * Refresh known-cves.json from OSV.dev for the given ecosystems.
- * Queries each package already in the database to get up-to-date CVE data.
- * Writes updated JSON via atomicWriteFile. Records refresh in cve-refresh-log.json.
- */
-export declare function refreshCveDatabase(ecosystems: string[]): Promise<void>;
-//# sourceMappingURL=cve-refresher.d.ts.map

package/dist/engine/security/cve-refresher.js

@@ -1,128 +0,0 @@
-// engine/security/cve-refresher.ts — SPEC-773
-// Auto-refresh known-cves.json from OSV.dev public API.
-import { stat, readFile, mkdir } from 'node:fs/promises';
-import { resolve, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { atomicWriteFile } from '../safety/atomic-write-file.js';
-import { globalDataDir } from '../../storage/base-store.js';
-const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
-export const CVE_DB_PATH = resolve(MODULE_DIR, '../../config/known-cves.json');
-const OSV_API = 'https://api.osv.dev/v1/query';
-const STALE_THRESHOLD_MS = 7 * 24 * 60 * 60 * 1000;
-/** Check if known-cves.json is older than 7 days. */
-export async function isCveDatabaseStale() {
-    try {
-        const s = await stat(CVE_DB_PATH);
-        const ageMs = Date.now() - s.mtimeMs;
-        return { stale: ageMs > STALE_THRESHOLD_MS, ageDays: Math.floor(ageMs / 86400000) };
-    }
-    catch {
-        return { stale: true, ageDays: 999 };
-    }
-}
-function toEntry(vuln, pkgName, ecosystem) {
-    const cveId = vuln.aliases?.find((a) => a.startsWith('CVE-'));
-    if (!cveId) {
-        return null;
-    }
-    let fixVersion;
-    outer: for (const aff of vuln.affected ?? []) {
-        for (const range of aff.ranges ?? []) {
-            for (const ev of range.events ?? []) {
-                if (ev.fixed) {
-                    fixVersion = ev.fixed;
-                    break outer;
-                }
-            }
-        }
-    }
-    const score = parseFloat(vuln.affected?.[0]?.severity?.[0]?.score ?? '0');
-    const severity = score >= 7 ? 'critical' : 'warning';
-    return {
-        package: pkgName,
-        ecosystem,
-        affectedVersions: fixVersion ? `<${fixVersion}` : 'unknown',
-        cveId,
-        severity,
-        description: vuln.summary ?? '',
-        ...(fixVersion ? { fixVersion } : {}),
-    };
-}
-/**
- * Refresh known-cves.json from OSV.dev for the given ecosystems.
- * Queries each package already in the database to get up-to-date CVE data.
- * Writes updated JSON via atomicWriteFile. Records refresh in cve-refresh-log.json.
- */
-export async function refreshCveDatabase(ecosystems) {
-    let currentDb;
-    try {
-        const raw = await readFile(CVE_DB_PATH, 'utf-8');
-        currentDb = JSON.parse(raw);
-    }
-    catch {
-        currentDb = { lastUpdated: '', vulnerabilities: [] };
-    }
-    // Build package list per ecosystem for ecosystems being refreshed (AC-5: ecosystem-scoped)
-    const byEcosystem = new Map();
-    for (const vuln of currentDb.vulnerabilities) {
-        if (!ecosystems.includes(vuln.ecosystem)) {
-            continue;
-        }
-        const set = byEcosystem.get(vuln.ecosystem) ?? new Set();
-        set.add(vuln.package);
-        byEcosystem.set(vuln.ecosystem, set);
-    }
-    // Query OSV.dev per package with ecosystem filter (not a generic all-ecosystems fetch)
-    const freshVulns = [];
-    for (const [ecosystem, packages] of byEcosystem) {
-        for (const pkgName of packages) {
-            try {
-                const resp = await fetch(OSV_API, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ package: { name: pkgName, ecosystem } }),
-                });
-                if (!resp.ok) {
-                    continue;
-                }
-                const data = (await resp.json());
-                for (const vuln of data.vulns ?? []) {
-                    const entry = toEntry(vuln, pkgName, ecosystem);
-                    if (entry) {
-                        freshVulns.push(entry);
-                    }
-                }
-            }
-            catch {
-                // per-package error — skip and continue
-            }
-        }
-    }
-    // Preserve untouched ecosystems; replace refreshed ones with fresh data (or keep stale if
-    // OSV returned nothing new for that ecosystem)
-    const untouched = currentDb.vulnerabilities.filter((v) => !ecosystems.includes(v.ecosystem));
-    const refreshedEcos = new Set(freshVulns.map((v) => v.ecosystem));
-    const staleKept = currentDb.vulnerabilities.filter((v) => ecosystems.includes(v.ecosystem) && !refreshedEcos.has(v.ecosystem));
-    const merged = [...untouched, ...staleKept, ...freshVulns];
-    const updatedDb = {
-        lastUpdated: new Date().toISOString().slice(0, 10),
-        vulnerabilities: merged,
-    };
-    await atomicWriteFile(CVE_DB_PATH, JSON.stringify(updatedDb, null, 2));
-    // Write refresh log (best-effort — non-fatal)
-    try {
-        const dir = globalDataDir();
-        await mkdir(dir, { recursive: true });
-        const log = {
-            refreshedAt: new Date().toISOString(),
-            source: 'osv.dev',
-            ecosystems,
-            entryCount: merged.length,
-        };
-        await atomicWriteFile(`${dir}/cve-refresh-log.json`, JSON.stringify(log, null, 2));
-    }
-    catch {
-        // log write failure is non-fatal
-    }
-}
-//# sourceMappingURL=cve-refresher.js.map