@planu/cli 5.1.1 → 5.2.0

package/dist/tools/init-project/handler.js

@@ -11,6 +11,7 @@ import { analyzeProject, checkProjectCompleteness } from '../../engine/analyzer.
 import { parseProjectQualityRules } from '../../engine/auditor-claude-md.js';
 import { detectMissingAreas, buildRequestPrompt } from '../../engine/context-merger.js';
 import { detectProjectPrivacyConfig, maybeGenerateEnvExample, buildBeginnerEnvGuide, } from './helpers.js';
+import { buildDefaultPrivacyConfig } from '../../engine/pii-detector.js';
 import { checkBundledVersionGap } from '../../engine/version-detector/bundled-version-checker.js';
 import { checkAndFixBundledVersion } from '../../engine/mcp-config/mcp-config-writer.js';
 import { buildInitProjectResult } from './result-builder.js';
@@ -86,6 +87,25 @@ function detectMultipleFrameworks(stack) {
     }
     return null;
 }
+/**
+ * SPEC-1343: Runs one independent, best-effort pipeline stage in isolation so it can be
+ * batched with `Promise.all` alongside other independent stages. A rejection never
+ * propagates to the caller — it resolves to `fallback` and is flagged via `failed`/`error`
+ * so init_project can still succeed and surface the failure in its result summary (AC2).
+ */
+async function runOptionalStage(name, fallback, task) {
+    try {
+        return { name, value: await task(), failed: false };
+    }
+    catch (err) {
+        return {
+            name,
+            value: fallback,
+            failed: true,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
 // eslint-disable-next-line max-lines-per-function
 export async function handleInitProject(params, server) {
     // eslint-disable-next-line max-lines-per-function, complexity
@@ -256,8 +276,14 @@ export async function handleInitProject(params, server) {
             const globalConfig = await globalStore.getGlobalConfig();
             const effectiveLocale = locale ?? globalConfig.defaultLocale;
             const effectiveExperience = experienceLevel ?? globalConfig.defaultExperienceLevel;
-            // Run full project analysis
-            const knowledge = await analyzeProject(projectPath, projectId, effectiveLocale, effectiveExperience);
+            // SPEC-1343: analyzeProject (full tree scan) and detectStackPatterns are both
+            // independent read-only scans of the same project tree — run them concurrently
+            // instead of back-to-back so wall time is ~1x the slower stage, not the sum (AC1).
+            const [knowledge, stackResult] = await Promise.all([
+                analyzeProject(projectPath, projectId, effectiveLocale, effectiveExperience),
+                detectStackPatterns(projectPath),
+            ]);
+            const { modernPatterns, dddConfig, agileDetection, orchestratorInfo, composeMultiplatform } = stackResult;
             if (approvedTechnologyContract !== null) {
                 knowledge.language = approvedTechnologyContract.language ?? knowledge.language;
                 knowledge.framework =
@@ -330,9 +356,6 @@ export async function handleInitProject(params, server) {
             if (hourlyRate !== undefined) {
                 await globalStore.updateGlobalConfig({ hourlyRate });
             }
-            // SPEC-033: Detect modern architecture patterns and stack info
-            const stackResult = await detectStackPatterns(projectPath);
-            const { modernPatterns, dddConfig, agileDetection, orchestratorInfo, composeMultiplatform } = stackResult;
             // SPEC-568: Smart tool group activation based on detected stack.
             // Runs before saveKnowledge so the snapshot can be persisted in one write.
             const groupProfileSnapshot = applyStackBasedGroupActivations(knowledge.stack);
@@ -352,16 +375,54 @@ export async function handleInitProject(params, server) {
             addProject(projectPath).catch(() => {
                 /* best-effort — never block init_project */
             });
+            // SPEC-1343: buildProjectConfig -> runSpecMigrations must stay ordered (config must be
+            // written before migrations run against it, and runSpecMigrations is invoked exactly
+            // once per run, AC3). That ordered chain is independent of the read-only discovery
+            // batch below, so both run concurrently (AC1/AC4).
             // SPEC-131: Build legal profile and generate planu.json / What's New
             // SPEC-313: Pass workMode to persist in planu.json
-            const configResult = await buildProjectConfig(projectPath, projectId, knowledge, workMode);
+            const configAndMigrations = (async () => {
+                const configResult = await buildProjectConfig(projectPath, projectId, knowledge, workMode);
+                // Run spec migrations (v0.30 -> v0.40, legacy paths, prefix normalization)
+                const migrations = await runSpecMigrations(projectPath, projectId, knowledge, {
+                    repositoryMigration: 'initialization',
+                });
+                return { configResult, migrations };
+            })();
+            // SPEC-1343: Independent, best-effort discovery stages (skills fetch, privacy
+            // detection, health check, convention scan) — none of these feed each other, so they
+            // batch into a single Promise.all with per-stage error isolation. A failing optional
+            // stage falls back to a safe default instead of failing init_project (AC2).
+            const [recommendedSkillsOutcome, privacyConfigOutcome, healthReportOutcome, conventionScanOutcome,] = await Promise.all([
+                runOptionalStage('fetchRecommendedSkills', [], () => fetchRecommendedSkills(knowledge)),
+                runOptionalStage('detectProjectPrivacyConfig', buildDefaultPrivacyConfig('GDPR', []), () => detectProjectPrivacyConfig(projectPath)),
+                runOptionalStage('runHealthCheckWithBaseline', null, async () => {
+                    const allSpecs = await listProjectSpecs(projectId);
+                    const specSummaries = allSpecs.map((s) => ({
+                        specId: s.id,
+                        status: s.status,
+                        gitBranch: s.gitBranch,
+                        updatedAt: s.updatedAt,
+                    }));
+                    return runHealthCheckWithBaseline(projectPath, projectId, knowledge, specSummaries);
+                }),
+                runOptionalStage('runConventionScanSafe', 'failed', () => runConventionScanSafe(projectPath)),
+            ]);
+            const recommendedSkills = recommendedSkillsOutcome.value;
+            const privacyConfig = privacyConfigOutcome.value;
+            const healthReport = healthReportOutcome.value;
+            const conventionScanStatus = conventionScanOutcome.value;
+            const optionalStageFailures = [
+                recommendedSkillsOutcome,
+                privacyConfigOutcome,
+                healthReportOutcome,
+                conventionScanOutcome,
+            ]
+                .filter((outcome) => outcome.failed)
+                .map((outcome) => `${outcome.name}: ${outcome.error ?? 'unknown error'}`);
+            const { configResult, migrations } = await configAndMigrations;
             const { planuConfigPath, planuConfigGenerated, whatsNew } = configResult;
-            // Run spec migrations (v0.30 -> v0.40, legacy paths, prefix normalization)
-            const { discoveryResult, migrationResult, folderMigrationResult, criticalMigrationFailures, nonCriticalWarnings: nonCriticalMigrationWarnings, migrationReportPath, changedPaths: migrationChangedPaths = [], } = await runSpecMigrations(projectPath, projectId, knowledge, {
-                repositoryMigration: 'initialization',
-            });
-            // Auto-fetch recommended skills based on detected stack
-            const recommendedSkills = await fetchRecommendedSkills(knowledge);
+            const { discoveryResult, migrationResult, folderMigrationResult, criticalMigrationFailures, nonCriticalWarnings: nonCriticalMigrationWarnings, migrationReportPath, changedPaths: migrationChangedPaths = [], } = migrations;
             // Auto-install or queue skills (opt-out via planu.json or input param, SPEC-185)
             const autoInstallFromConfig = autoInstallSkills ?? (await readAutoInstallFlag(planuConfigPath));
             const { skillsAutoInstalled, skillsPendingInstall, skillsSkipped } = await orchestrateSkillInstalls(recommendedSkills, projectPath, autoInstallFromConfig);
@@ -393,17 +454,6 @@ export async function handleInitProject(params, server) {
             const beginnerEnvGuide = effectiveExperience === 'beginner' && envVars.length > 0
                 ? buildBeginnerEnvGuide(envVars)
                 : null;
-            // SPEC-030: Detect legal framework and third-party data processors
-            const privacyConfig = await detectProjectPrivacyConfig(projectPath);
-            // SPEC-180: Project health check (best-effort)
-            const allSpecs = await listProjectSpecs(projectId);
-            const specSummaries = allSpecs.map((s) => ({
-                specId: s.id,
-                status: s.status,
-                gitBranch: s.gitBranch,
-                updatedAt: s.updatedAt,
-            }));
-            const healthReport = await runHealthCheckWithBaseline(projectPath, projectId, knowledge, specSummaries);
             // SPEC-491: Auto-cleanup planu/ — remove legacy HTMLs, migrate to lean spec format (fire-and-forget)
             import('../../engine/spec-migrator/planu-root-cleaner.js')
                 .then(({ cleanPlanuRoot }) => cleanPlanuRoot(join(projectPath, 'planu')))
@@ -414,8 +464,6 @@ export async function handleInitProject(params, server) {
             void withAudit(projectPath, 'init_project', 'regeneratePages', () => regeneratePages(projectPath, ['knowledge', 'risks', 'decisions']), (pages) => ({ pages: pages.length })).catch(() => {
                 /* best-effort — never fail init */
             });
-            // SPEC-228: Deep scan — detect conventions and write planu/conventions.json (best-effort)
-            const conventionScanStatus = await runConventionScanSafe(projectPath);
             // SPEC-645: Detect LLM client and cache in conventions.json (fire-and-forget)
             void import('../../engine/client-detection.js')
                 .then(({ detectAndCacheClient }) => detectAndCacheClient(projectPath))
@@ -480,6 +528,11 @@ export async function handleInitProject(params, server) {
             }
             // SPEC-469: Build autopilot summary from setup steps performed
             const collector = new AutopilotSummaryCollector();
+            // SPEC-1343 AC2: surface optional discovery-stage failures in the result summary
+            // instead of failing init_project.
+            for (const failure of optionalStageFailures) {
+                collector.pushFail('discovery-stage-failed', failure);
+            }
             if (knowledge.stack.length > 0) {
                 collector.pushOk('stack-detection', `Stack detected: ${knowledge.stack.join(', ')}`);
             }

package/dist/tools/learn.js

@@ -3,8 +3,8 @@
 // to pattern-store for future use by estimation, auditing, and spec generation.
 // SPEC-011: adds dispatchFeedbackEvent for feedback loop dispatch.
 import { patternStore, knowledgeStore } from '../storage/index.js';
+import { SemanticIndexStore } from '../storage/semantic-index-store.js';
 import { t, ti } from '../i18n/index.js';
-import { TFIDFEngine } from '../engine/vector-store/tfidf.js';
 import { cosineSimilarity } from '../engine/vector-store/similarity.js';
 import { compactJson } from './output-formatter.js';
 /** Default cosine similarity threshold for semantic deduplication. */
@@ -45,7 +45,7 @@ export async function handleLearn(args) {
         };
     }
     // 3. Semantic deduplication check (SPEC-075 AC-08)
-    const dedupWarning = checkSemanticDuplicate(existingPatterns, pattern, type);
+    const dedupWarning = await checkSemanticDuplicate(projectId, existingPatterns, pattern, type);
     // 4. Create new pattern (store even if semantically similar — just warn)
     const patternId = `PAT-${type.substring(0, 3).toUpperCase()}-${Date.now().toString(36).toUpperCase()}`;
     const learnedPattern = {
@@ -93,18 +93,20 @@ export async function handleLearn(args) {
 /**
  * SPEC-075 AC-08: Check existing patterns for semantic similarity using TF-IDF.
  * Returns a DedupWarning if a pattern with cosine similarity > threshold exists.
+ * SPEC-1345: the same-type corpus is loaded from a persisted, incrementally
+ * updated TF-IDF index instead of being rebuilt from scratch on every call.
  */
-function checkSemanticDuplicate(existingPatterns, newPattern, patternType, threshold = DEFAULT_DEDUP_THRESHOLD) {
+async function checkSemanticDuplicate(projectId, existingPatterns, newPattern, patternType, threshold = DEFAULT_DEDUP_THRESHOLD) {
     // Filter to same-type patterns only
     const sameType = existingPatterns.filter((p) => p.type === patternType);
     if (sameType.length === 0) {
         return undefined;
     }
-    // Build TF-IDF engine from existing patterns + the new one
-    const tfidf = new TFIDFEngine();
-    for (const p of sameType) {
-        tfidf.addDocument(p.pattern);
-    }
+    const indexStore = new SemanticIndexStore(projectId, `pattern-${patternType}`);
+    const tfidf = await indexStore.loadOrBuild(sameType.map((p) => ({ id: p.id, content: p.pattern })));
+    // Embed the candidate in-memory only (it isn't stored yet, so it never
+    // becomes part of the persisted corpus) so the IDF reflects it, matching
+    // the previous non-persisted behavior.
     tfidf.addDocument(newPattern);
     // Embed the new pattern
     const newEmbedding = tfidf.embed(newPattern);

package/dist/tools/registry/auth.js

@@ -22,8 +22,6 @@ export async function handleRegistryLogin(args) {
         const token = args.token;
         const user = args.user;
         const email = args.email;
-        const rawPlan = args.plan;
-        const plan = rawPlan ?? 'free';
         const expiresAt = args.expiresAt;
         if (!token || !user || !email) {
             return {
@@ -37,7 +35,6 @@ export async function handleRegistryLogin(args) {
             token: await storeSecretField('global/registry/pat', 'registry-pat', token),
             user,
             email,
-            plan,
             expiresAt: expiresAt ?? new Date(Date.now() + TOKEN_EXPIRY_MS).toISOString(),
         };
         const credPath = credentialsPath();
@@ -45,12 +42,7 @@ export async function handleRegistryLogin(args) {
         await chmod(resolveStorageLayout().secrets, 0o700);
         await writeFile(credPath, JSON.stringify(credentials, null, 2), 'utf-8');
         await chmod(credPath, 0o600);
-        return compactResult([
-            `Done: Logged in successfully`,
-            `**user**: ${user}`,
-            `**email**: ${email}`,
-            `**plan**: ${plan}`,
-        ].join('\n'));
+        return compactResult([`Done: Logged in successfully`, `**user**: ${user}`, `**email**: ${email}`].join('\n'));
     }
     catch (error) {
         /* v8 ignore start -- unexpected runtime errors */
@@ -100,7 +92,6 @@ export async function handleRegistryWhoami(_args) {
         const info = {
             user: cred.user,
             email: cred.email,
-            plan: cred.plan,
             expiresAt: cred.expiresAt,
             expired: isExpired,
             authenticated: !isExpired,
@@ -108,7 +99,6 @@ export async function handleRegistryWhoami(_args) {
         return compactResult([
             `**user**: ${info.user}`,
             `**email**: ${info.email}`,
-            `**plan**: ${info.plan}`,
             `**expiresAt**: ${info.expiresAt}`,
             `**expired**: ${String(info.expired)}`,
             `**authenticated**: ${String(info.authenticated)}`,

package/dist/tools/semantic-search-handler.js

@@ -1,7 +1,7 @@
 // tools/semantic-search-handler.ts — Handler for semantic_search tool.
 // SPEC-075 AC-07: Generates TF-IDF embedding of query, searches backend.
 import { getOrCreateBackend } from '../storage/vector-store/backend-factory.js';
-import { TFIDFEngine } from '../engine/vector-store/tfidf.js';
+import { SemanticIndexStore } from '../storage/semantic-index-store.js';
 /**
  * Handle a semantic_search request.
  * Embeds the query with TF-IDF, then searches the vector backend.
@@ -33,11 +33,10 @@ export async function handleSemanticSearch(args) {
             ],
         };
     }
-    // Build TF-IDF from existing corpus
-    const tfidf = new TFIDFEngine();
-    for (const doc of allDocs) {
-        tfidf.addDocument(doc.content);
-    }
+    // SPEC-1345: load the persisted TF-IDF index for this scope, incrementally
+    // reconciled against the current corpus (no full rebuild for unchanged docs).
+    const indexStore = new SemanticIndexStore(projectId, scope);
+    const tfidf = await indexStore.loadOrBuild(allDocs.map((doc) => ({ id: doc.id, content: doc.content })));
     // Embed the query
     const queryEmbedding = tfidf.embed(query);
     // Search

package/dist/tools/status-handler.js

@@ -79,18 +79,28 @@ function parseSpecNumber(id) {
     const match = /SPEC-(\d+)/i.exec(id);
     return match?.[1] !== undefined ? parseInt(match[1], 10) : 0;
 }
+function selectActiveSpec(specs) {
+    // Lifecycle-first ordering: implementing always outranks review, regardless of SPEC number.
+    // Within the same lifecycle status, the tie-break is descending SPEC number (most recent first).
+    for (const status of ['implementing', 'review']) {
+        const candidates = specs
+            .filter((s) => s.status === status)
+            .sort((a, b) => parseSpecNumber(b.id) - parseSpecNumber(a.id));
+        const candidate = candidates[0];
+        if (candidate !== undefined) {
+            return { id: candidate.id, title: candidate.title, status };
+        }
+    }
+    return null;
+}
 async function getStatusSpecSnapshot(projectId) {
     try {
         const specs = await listSpecs(projectId);
-        const inProgress = specs
-            .filter((s) => s.status === 'implementing' || s.status === 'review')
-            .sort((a, b) => parseSpecNumber(b.id) - parseSpecNumber(a.id));
+        const active = selectActiveSpec(specs.filter((s) => s.status === 'implementing' || s.status === 'review'));
         const approved = specs
             .filter((s) => s.status === 'approved')
             .sort((a, b) => parseSpecNumber(a.id) - parseSpecNumber(b.id));
-        const activeItem = inProgress[0];
         const nextItem = approved[0];
-        const active = activeItem !== undefined ? { id: activeItem.id, title: activeItem.title } : null;
         const next = nextItem !== undefined ? { id: nextItem.id, title: nextItem.title } : null;
         return { active, next, queueCount: approved.length };
     }
@@ -130,6 +140,9 @@ async function getSLABreaches(projectId) {
 // ---------------------------------------------------------------------------
 function buildSuggestion(snapshot) {
     if (snapshot.active !== null) {
+        if (snapshot.active.status === 'review') {
+            return `Resolve review for ${snapshot.active.id} — it is not yet implementing`;
+        }
         return `Continue ${snapshot.active.id} — it may be blocking others`;
     }
     if (snapshot.next !== null) {
@@ -145,7 +158,7 @@ function buildOutput(params) {
     const lines = ['Planu Status', '━━━━━━━━━━━━━━━'];
     if (snapshot.active !== null) {
         const title = snapshot.active.title.slice(0, 40);
-        lines.push(`ACTIVE    ${snapshot.active.id} ${title} (in-progress)`);
+        lines.push(`ACTIVE    ${snapshot.active.id} ${title} (${snapshot.active.status})`);
     }
     else {
         lines.push(`ACTIVE    (none)`);

package/dist/tools/validation-loop-handler.js

@@ -34,22 +34,20 @@ export async function handleSpecHealthCheck(input) {
         content: [{ type: 'text', text: lines.join('\n') }],
     };
 }
-import { isNativeActive, fastScanSpecs } from '../engine/core-bridge.js';
+import { fastScanSpecsAsync } from '../engine/core-bridge.js';
 export async function handleHealthCheckAll(input) {
-    if (isNativeActive()) {
-        const briefs = fastScanSpecs(input.projectPath);
-        if (briefs) {
-            // Sort worst to best
-            briefs.sort((a, b) => a.healthScore - b.healthScore);
-            const lines = [
-                `Health check for all ${briefs.length} specs (sorted worst to best) [NATIVE]:`,
-                ``,
-                ...briefs.map((b) => `  ${b.id}: ${b.healthScore}/100`),
-            ];
-            return {
-                content: [{ type: 'text', text: lines.join('\n') }],
-            };
-        }
+    const { value: briefs, degradationNotice } = await fastScanSpecsAsync(input.projectPath);
+    if (briefs) {
+        // Sort worst to best
+        briefs.sort((a, b) => a.healthScore - b.healthScore);
+        const lines = [
+            `Health check for all ${briefs.length} specs (sorted worst to best) [NATIVE]:`,
+            ``,
+            ...briefs.map((b) => `  ${b.id}: ${b.healthScore}/100`),
+        ];
+        return {
+            content: [{ type: 'text', text: lines.join('\n') }],
+        };
     }
     const projectId = hashProjectPath(input.projectPath);
     const specs = await specStore.listSpecs(projectId);
@@ -66,6 +64,9 @@ export async function handleHealthCheckAll(input) {
         ``,
         ...scores.map((s) => `  ${s.specId}: ${s.total}/100`),
     ];
+    if (degradationNotice !== undefined) {
+        lines.push('', degradationNotice);
+    }
     return {
         content: [{ type: 'text', text: lines.join('\n') }],
     };

package/dist/types/spec-language-translation.d.ts

@@ -0,0 +1,18 @@
+import type { InteractiveQuestion } from './interactive-question.js';
+/** Outcome of resolving the English-only gate for create_spec's title/description. */
+export type EnglishOnlyGateAction = 'ok' | 'ask' | 'translated' | 'reject';
+/** Result of `resolveEnglishOnlySpecGate`. Shape depends on `action`. */
+export interface EnglishOnlyGateResolution {
+    action: EnglishOnlyGateAction;
+    /** Set for 'ask' | 'translated' | 'reject' — the language detected in the original input. */
+    originalLanguage?: 'es' | 'pt';
+    /** Set for 'ask' — the translation clarification questions to relay via AskUserQuestion. */
+    questions?: InteractiveQuestion[];
+    /** Set for 'reject' — human-readable reason from the underlying language detector. */
+    reason?: string;
+    /** Set for 'translated' — the English title to use instead of the original. */
+    englishTitle?: string;
+    /** Set for 'translated' — the English description to use instead of the original. */
+    englishDescription?: string;
+}
+//# sourceMappingURL=spec-language-translation.d.ts.map

package/dist/types/spec-language-translation.js

@@ -0,0 +1,5 @@
+// types/spec-language-translation.ts — SPEC-1342: translation-request shapes for the
+// English-only spec gate. Lets create_spec offer an in-band translation clarification
+// round instead of hard-rejecting non-English title/description input.
+export {};
+//# sourceMappingURL=spec-language-translation.js.map

package/dist/types/spec-registry.d.ts

@@ -87,8 +87,6 @@ export interface RegistryCredentials {
     user: string;
     /** Email associated with the account. */
     email: string;
-    /** License plan level. */
-    plan: 'free' | 'pro';
     /** ISO 8601 token expiration timestamp. */
     expiresAt: string;
 }

package/dist/types/status.d.ts

@@ -10,10 +10,12 @@ export interface GitState {
 export interface SessionState {
     lastCiStatus?: string;
 }
+export type StatusActiveLifecycleStatus = 'implementing' | 'review';
 export interface StatusSpecSnapshot {
     active: {
         id: string;
         title: string;
+        status: StatusActiveLifecycleStatus;
     } | null;
     next: {
         id: string;

package/dist/types/vector-store.d.ts

@@ -21,6 +21,24 @@ export interface TFIDFConfig {
     minDocFrequency: number;
     stopWords: Set<string>;
 }
+/** Serializable TF-IDF engine state (SPEC-1345: persisted index). */
+export interface TFIDFExportedState {
+    schemaVersion: number;
+    docFreq: [string, number][];
+    docCount: number;
+}
+/** A single corpus document as seen by the persisted semantic index (SPEC-1345). */
+export interface SemanticIndexDoc {
+    id: string;
+    content: string;
+}
+/** On-disk shape of a persisted TF-IDF index + hash manifest (SPEC-1345). */
+export interface PersistedSemanticIndex {
+    schemaVersion: number;
+    docHashes: Record<string, string>;
+    docTokens: Record<string, string[]>;
+    tfidfState: TFIDFExportedState;
+}
 /** Configuration for the HNSW index. */
 export interface HNSWConfig {
     M: number;

package/dist/types/workers.d.ts

@@ -8,7 +8,6 @@ export interface WorkerTrigger {
     /** Interval in ms for schedule triggers */
     intervalMs?: number;
 }
-export type WorkerTier = 'free' | 'pro';
 export interface WorkerDefinition {
     name: string;
     description: string;
@@ -19,7 +18,6 @@ export interface WorkerDefinition {
     /** Minimum ms between executions */
     cooldownMs: number;
     enabled: boolean;
-    tier: WorkerTier;
 }
 export type WorkerFindingSeverity = 'critical' | 'high' | 'medium' | 'low' | 'warning' | 'info';
 export interface WorkerFinding {
@@ -66,7 +64,6 @@ export interface WorkerOverride {
     enabled?: boolean;
     cooldownMs?: number;
     priority?: number;
-    tier?: WorkerTier;
 }
 export interface WorkerProjectConfig {
     overrides: Record<string, WorkerConfigOverride>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "5.1.1",
+  "version": "5.2.0",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -35,14 +35,14 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "5.1.1",
-    "@planu/core-darwin-x64": "5.1.1",
-    "@planu/core-linux-arm64-gnu": "5.1.1",
-    "@planu/core-linux-arm64-musl": "5.1.1",
-    "@planu/core-linux-x64-gnu": "5.1.1",
-    "@planu/core-linux-x64-musl": "5.1.1",
-    "@planu/core-win32-arm64-msvc": "5.1.1",
-    "@planu/core-win32-x64-msvc": "5.1.1"
+    "@planu/core-darwin-arm64": "5.2.0",
+    "@planu/core-darwin-x64": "5.2.0",
+    "@planu/core-linux-arm64-gnu": "5.2.0",
+    "@planu/core-linux-arm64-musl": "5.2.0",
+    "@planu/core-linux-x64-gnu": "5.2.0",
+    "@planu/core-linux-x64-musl": "5.2.0",
+    "@planu/core-win32-arm64-msvc": "5.2.0",
+    "@planu/core-win32-x64-msvc": "5.2.0"
   },
   "engines": {
     "node": ">=24.0.0"

package/planu-native.json

@@ -1,26 +1,20 @@
 {
   "name": "dev.planu.native",
   "displayName": "Planu Native Lightweight Surface",
-  "version": "5.1.1",
+  "version": "5.2.0",
   "packageName": "@planu/cli",
   "modes": {
     "lightweight": {
       "requiresMcp": false,
       "requiresDaemon": false,
-      "hosts": [
-        "codex",
-        "claude-code"
-      ],
+      "hosts": ["codex", "claude-code"],
       "commands": [
         {
           "id": "planu.status",
           "title": "Project status",
           "description": "Show the compact Planu project snapshot without loading the MCP tool graph.",
           "invocation": "planu status",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handlePlanStatus"
@@ -30,10 +24,7 @@
           "title": "Create spec",
           "description": "Create a new spec through the CLI-backed SDD contract.",
           "invocation": "planu spec create \"<title>\"",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleCreateSpec"
@@ -43,10 +34,7 @@
           "title": "List specs",
           "description": "List specs in the current project with optional status/type filters.",
           "invocation": "planu spec list",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleListSpecs"
@@ -56,10 +44,7 @@
           "title": "Validate spec",
           "description": "Validate a spec against the current codebase from the native CLI surface.",
           "invocation": "planu spec validate SPEC-001",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleValidate"
@@ -69,10 +54,7 @@
           "title": "Audit technical debt",
           "description": "Run the read-only project audit path for lightweight debt checks.",
           "invocation": "planu audit debt",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleAudit"
@@ -82,10 +64,7 @@
           "title": "Check release readiness",
           "description": "Check local-first release readiness, branch cleanliness, and optional gitflow drift.",
           "invocation": "planu release check",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "releaseCommand"

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "5.1.1",
+  "version": "5.2.0",
   "icon": "assets/plugin/icon.svg",
   "command": ["npx", "@planu/cli@latest"],
   "packageName": "@planu/cli",

package/dist/engine/security/cve-refresher.d.ts

@@ -1,12 +0,0 @@
-import type { StalenessInfo } from '../../types/security/index.js';
-export type { StalenessInfo };
-export declare const CVE_DB_PATH: string;
-/** Check if known-cves.json is older than 7 days. */
-export declare function isCveDatabaseStale(): Promise<StalenessInfo>;
-/**
- * Refresh known-cves.json from OSV.dev for the given ecosystems.
- * Queries each package already in the database to get up-to-date CVE data.
- * Writes updated JSON via atomicWriteFile. Records refresh in cve-refresh-log.json.
- */
-export declare function refreshCveDatabase(ecosystems: string[]): Promise<void>;
-//# sourceMappingURL=cve-refresher.d.ts.map