@planu/cli 5.1.1 → 5.3.0

package/planu-native.json

@@ -1,26 +1,20 @@
 {
   "name": "dev.planu.native",
   "displayName": "Planu Native Lightweight Surface",
-  "version": "5.1.1",
+  "version": "5.3.0",
   "packageName": "@planu/cli",
   "modes": {
     "lightweight": {
       "requiresMcp": false,
       "requiresDaemon": false,
-      "hosts": [
-        "codex",
-        "claude-code"
-      ],
+      "hosts": ["codex", "claude-code"],
       "commands": [
         {
           "id": "planu.status",
           "title": "Project status",
           "description": "Show the compact Planu project snapshot without loading the MCP tool graph.",
           "invocation": "planu status",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handlePlanStatus"
@@ -30,10 +24,7 @@
           "title": "Create spec",
           "description": "Create a new spec through the CLI-backed SDD contract.",
           "invocation": "planu spec create \"<title>\"",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleCreateSpec"
@@ -43,10 +34,7 @@
           "title": "List specs",
           "description": "List specs in the current project with optional status/type filters.",
           "invocation": "planu spec list",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleListSpecs"
@@ -56,10 +44,7 @@
           "title": "Validate spec",
           "description": "Validate a spec against the current codebase from the native CLI surface.",
           "invocation": "planu spec validate SPEC-001",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleValidate"
@@ -69,10 +54,7 @@
           "title": "Audit technical debt",
           "description": "Run the read-only project audit path for lightweight debt checks.",
           "invocation": "planu audit debt",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "handleAudit"
@@ -82,10 +64,7 @@
           "title": "Check release readiness",
           "description": "Check local-first release readiness, branch cleanliness, and optional gitflow drift.",
           "invocation": "planu release check",
-          "hosts": [
-            "codex",
-            "claude-code"
-          ],
+          "hosts": ["codex", "claude-code"],
           "requiresMcp": false,
           "requiresDaemon": false,
           "mapsTo": "releaseCommand"

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "5.1.1",
+  "version": "5.3.0",
   "icon": "assets/plugin/icon.svg",
   "command": ["npx", "@planu/cli@latest"],
   "packageName": "@planu/cli",

package/dist/engine/security/cve-refresher.d.ts

@@ -1,12 +0,0 @@
-import type { StalenessInfo } from '../../types/security/index.js';
-export type { StalenessInfo };
-export declare const CVE_DB_PATH: string;
-/** Check if known-cves.json is older than 7 days. */
-export declare function isCveDatabaseStale(): Promise<StalenessInfo>;
-/**
- * Refresh known-cves.json from OSV.dev for the given ecosystems.
- * Queries each package already in the database to get up-to-date CVE data.
- * Writes updated JSON via atomicWriteFile. Records refresh in cve-refresh-log.json.
- */
-export declare function refreshCveDatabase(ecosystems: string[]): Promise<void>;
-//# sourceMappingURL=cve-refresher.d.ts.map

package/dist/engine/security/cve-refresher.js

@@ -1,128 +0,0 @@
-// engine/security/cve-refresher.ts — SPEC-773
-// Auto-refresh known-cves.json from OSV.dev public API.
-import { stat, readFile, mkdir } from 'node:fs/promises';
-import { resolve, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { atomicWriteFile } from '../safety/atomic-write-file.js';
-import { globalDataDir } from '../../storage/base-store.js';
-const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
-export const CVE_DB_PATH = resolve(MODULE_DIR, '../../config/known-cves.json');
-const OSV_API = 'https://api.osv.dev/v1/query';
-const STALE_THRESHOLD_MS = 7 * 24 * 60 * 60 * 1000;
-/** Check if known-cves.json is older than 7 days. */
-export async function isCveDatabaseStale() {
-    try {
-        const s = await stat(CVE_DB_PATH);
-        const ageMs = Date.now() - s.mtimeMs;
-        return { stale: ageMs > STALE_THRESHOLD_MS, ageDays: Math.floor(ageMs / 86400000) };
-    }
-    catch {
-        return { stale: true, ageDays: 999 };
-    }
-}
-function toEntry(vuln, pkgName, ecosystem) {
-    const cveId = vuln.aliases?.find((a) => a.startsWith('CVE-'));
-    if (!cveId) {
-        return null;
-    }
-    let fixVersion;
-    outer: for (const aff of vuln.affected ?? []) {
-        for (const range of aff.ranges ?? []) {
-            for (const ev of range.events ?? []) {
-                if (ev.fixed) {
-                    fixVersion = ev.fixed;
-                    break outer;
-                }
-            }
-        }
-    }
-    const score = parseFloat(vuln.affected?.[0]?.severity?.[0]?.score ?? '0');
-    const severity = score >= 7 ? 'critical' : 'warning';
-    return {
-        package: pkgName,
-        ecosystem,
-        affectedVersions: fixVersion ? `<${fixVersion}` : 'unknown',
-        cveId,
-        severity,
-        description: vuln.summary ?? '',
-        ...(fixVersion ? { fixVersion } : {}),
-    };
-}
-/**
- * Refresh known-cves.json from OSV.dev for the given ecosystems.
- * Queries each package already in the database to get up-to-date CVE data.
- * Writes updated JSON via atomicWriteFile. Records refresh in cve-refresh-log.json.
- */
-export async function refreshCveDatabase(ecosystems) {
-    let currentDb;
-    try {
-        const raw = await readFile(CVE_DB_PATH, 'utf-8');
-        currentDb = JSON.parse(raw);
-    }
-    catch {
-        currentDb = { lastUpdated: '', vulnerabilities: [] };
-    }
-    // Build package list per ecosystem for ecosystems being refreshed (AC-5: ecosystem-scoped)
-    const byEcosystem = new Map();
-    for (const vuln of currentDb.vulnerabilities) {
-        if (!ecosystems.includes(vuln.ecosystem)) {
-            continue;
-        }
-        const set = byEcosystem.get(vuln.ecosystem) ?? new Set();
-        set.add(vuln.package);
-        byEcosystem.set(vuln.ecosystem, set);
-    }
-    // Query OSV.dev per package with ecosystem filter (not a generic all-ecosystems fetch)
-    const freshVulns = [];
-    for (const [ecosystem, packages] of byEcosystem) {
-        for (const pkgName of packages) {
-            try {
-                const resp = await fetch(OSV_API, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ package: { name: pkgName, ecosystem } }),
-                });
-                if (!resp.ok) {
-                    continue;
-                }
-                const data = (await resp.json());
-                for (const vuln of data.vulns ?? []) {
-                    const entry = toEntry(vuln, pkgName, ecosystem);
-                    if (entry) {
-                        freshVulns.push(entry);
-                    }
-                }
-            }
-            catch {
-                // per-package error — skip and continue
-            }
-        }
-    }
-    // Preserve untouched ecosystems; replace refreshed ones with fresh data (or keep stale if
-    // OSV returned nothing new for that ecosystem)
-    const untouched = currentDb.vulnerabilities.filter((v) => !ecosystems.includes(v.ecosystem));
-    const refreshedEcos = new Set(freshVulns.map((v) => v.ecosystem));
-    const staleKept = currentDb.vulnerabilities.filter((v) => ecosystems.includes(v.ecosystem) && !refreshedEcos.has(v.ecosystem));
-    const merged = [...untouched, ...staleKept, ...freshVulns];
-    const updatedDb = {
-        lastUpdated: new Date().toISOString().slice(0, 10),
-        vulnerabilities: merged,
-    };
-    await atomicWriteFile(CVE_DB_PATH, JSON.stringify(updatedDb, null, 2));
-    // Write refresh log (best-effort — non-fatal)
-    try {
-        const dir = globalDataDir();
-        await mkdir(dir, { recursive: true });
-        const log = {
-            refreshedAt: new Date().toISOString(),
-            source: 'osv.dev',
-            ecosystems,
-            entryCount: merged.length,
-        };
-        await atomicWriteFile(`${dir}/cve-refresh-log.json`, JSON.stringify(log, null, 2));
-    }
-    catch {
-        // log write failure is non-fatal
-    }
-}
-//# sourceMappingURL=cve-refresher.js.map