@planu/cli 5.3.19 → 5.3.20

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (24) hide show
  1. package/CHANGELOG.md +8 -0
  2. package/dist/engine/core-bridge.js +2 -2
  3. package/dist/engine/macos-keychain-native-port.d.ts +4 -4
  4. package/dist/engine/macos-keychain-native-port.js +29 -3
  5. package/dist/engine/planu-core.darwin-arm64.node.manifest.json +7 -7
  6. package/dist/engine/planu-core.darwin-arm64.node.sbom.json +4 -4
  7. package/dist/engine/planu-core.darwin-x64.node.manifest.json +7 -7
  8. package/dist/engine/planu-core.darwin-x64.node.sbom.json +4 -4
  9. package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json +7 -7
  10. package/dist/engine/planu-core.linux-arm64-gnu.node.sbom.json +4 -4
  11. package/dist/engine/planu-core.linux-arm64-musl.node.manifest.json +7 -7
  12. package/dist/engine/planu-core.linux-arm64-musl.node.sbom.json +4 -4
  13. package/dist/engine/planu-core.linux-x64-gnu.node.manifest.json +7 -7
  14. package/dist/engine/planu-core.linux-x64-gnu.node.sbom.json +4 -4
  15. package/dist/engine/planu-core.linux-x64-musl.node.manifest.json +7 -7
  16. package/dist/engine/planu-core.linux-x64-musl.node.sbom.json +4 -4
  17. package/dist/engine/planu-core.win32-arm64-msvc.node.manifest.json +7 -7
  18. package/dist/engine/planu-core.win32-arm64-msvc.node.sbom.json +4 -4
  19. package/dist/engine/planu-core.win32-x64-msvc.node.manifest.json +7 -7
  20. package/dist/engine/planu-core.win32-x64-msvc.node.sbom.json +4 -4
  21. package/dist/tools/check-readiness.js +8 -2
  22. package/package.json +9 -9
  23. package/planu-native.json +1 -1
  24. package/planu-plugin.json +1 -1
package/CHANGELOG.md CHANGED
@@ -1,3 +1,11 @@
1
+ ## [5.3.20] - 2026-08-12
2
+
3
+ ### Bug Fixes
4
+ - fix(release): unblock validate and privacy gates for v5.3.20
5
+ - fix(spec-1495): ground the outOfScope recommendation in the spec document
6
+ - fix(spec-1483): fail the native build on a version-mismatched artifact
7
+
8
+
1
9
  ## [5.3.19] - 2026-08-11
2
10
 
3
11
  ### Bug Fixes
package/dist/engine/core-bridge.js CHANGED
@@ -187,7 +187,7 @@ function loadNative() {
187
187
  return mod;
188
188
  }
189
189
  }
190
- loadDiagnostic = { attempted: attempts, errors };
190
+ loadDiagnostic = { ...loadDiagnostic, attempted: attempts, errors };
191
191
  return null;
192
192
  }
193
193
  function refreshNativeCapabilityDiagnostic() {
@@ -223,7 +223,7 @@ export function requireMacOSKeychainNativePort() {
223
223
  const keychainNative = loadNative();
224
224
  refreshNativeCapabilityDiagnostic();
225
225
  return createMacOSKeychainNativePort(process.platform, process.env.PLANU_NATIVE_PATH !== undefined ||
226
- process.env.NAPI_RS_NATIVE_LIBRARY_PATH !== undefined, process.env.DISABLE_NATIVE_CORE === '1', keychainNative, loadDiagnostic.origin, loadDiagnostic.compatibility?.handshake?.capabilities);
226
+ process.env.NAPI_RS_NATIVE_LIBRARY_PATH !== undefined, process.env.DISABLE_NATIVE_CORE === '1', keychainNative, loadDiagnostic.origin, loadDiagnostic.compatibility?.handshake?.capabilities, loadDiagnostic.compatibility);
227
227
  }
228
228
  // TypeScript fallbacks -------------------------------------------------------
229
229
  // These keep the surface area working when the native binary is unavailable
package/dist/engine/macos-keychain-native-port.d.ts CHANGED
@@ -1,10 +1,10 @@
1
- import type { PlanuCore } from '../types/core-bridge.js';
1
+ import type { NativeRuntimeCompatibility, PlanuCore } from '../types/core-bridge.js';
2
2
  import type { MacOSKeychainNativePort } from '../types/security.js';
3
3
  export declare class ValidationReceiptSignerUnavailableError extends Error {
4
- readonly reason: 'PLATFORM_UNSUPPORTED' | 'NATIVE_DISABLED' | 'ARTIFACT_MISSING' | 'NONCANONICAL_ORIGIN' | 'CAPABILITY_MISSING' | 'PORT_INCOMPLETE' | 'OVERRIDE_REJECTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE';
4
+ readonly reason: 'PLATFORM_UNSUPPORTED' | 'NATIVE_DISABLED' | 'ARTIFACT_MISSING' | 'STALE_ARTIFACT' | 'NONCANONICAL_ORIGIN' | 'CAPABILITY_MISSING' | 'PORT_INCOMPLETE' | 'OVERRIDE_REJECTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE';
5
5
  readonly code: 'VALIDATION_RECEIPT_SIGNER_UNAVAILABLE';
6
- constructor(reason: 'PLATFORM_UNSUPPORTED' | 'NATIVE_DISABLED' | 'ARTIFACT_MISSING' | 'NONCANONICAL_ORIGIN' | 'CAPABILITY_MISSING' | 'PORT_INCOMPLETE' | 'OVERRIDE_REJECTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE');
6
+ constructor(reason: 'PLATFORM_UNSUPPORTED' | 'NATIVE_DISABLED' | 'ARTIFACT_MISSING' | 'STALE_ARTIFACT' | 'NONCANONICAL_ORIGIN' | 'CAPABILITY_MISSING' | 'PORT_INCOMPLETE' | 'OVERRIDE_REJECTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE', remediation?: string);
7
7
  }
8
8
  /** Build the privileged main-thread port only from a canonical, verified native module. */
9
- export declare function createMacOSKeychainNativePort(platform: NodeJS.Platform, overrideDefined: boolean, disabled: boolean, nativeModule: PlanuCore | null, origin: 'override' | 'local' | 'package' | undefined, capabilities: readonly string[] | undefined): MacOSKeychainNativePort;
9
+ export declare function createMacOSKeychainNativePort(platform: NodeJS.Platform, overrideDefined: boolean, disabled: boolean, nativeModule: PlanuCore | null, origin: 'override' | 'local' | 'package' | undefined, capabilities: readonly string[] | undefined, compatibility?: NativeRuntimeCompatibility): MacOSKeychainNativePort;
10
10
  //# sourceMappingURL=macos-keychain-native-port.d.ts.map
package/dist/engine/macos-keychain-native-port.js CHANGED
@@ -1,14 +1,36 @@
1
+ import { PLANU_VERSION } from '../config/version.js';
2
+ const DEFAULT_REMEDIATION = 'Restart the MCP host and retry.';
3
+ /** Recover the native target triple from a buildId shaped `<epoch>-<engineVersion>-<triple>`. */
4
+ function deriveNativeTargetTriple(buildId, engineVersion) {
5
+ const separator = `-${engineVersion}-`;
6
+ const index = buildId.indexOf(separator);
7
+ if (index === -1) {
8
+ return null;
9
+ }
10
+ const triple = buildId.slice(index + separator.length);
11
+ return triple.length > 0 ? triple : null;
12
+ }
13
+ function staleArtifactRemediation(artifactVersion, buildId) {
14
+ const triple = buildId ? deriveNativeTargetTriple(buildId, artifactVersion) : null;
15
+ if (!triple) {
16
+ return (`Native artifact reports engineVersion ${artifactVersion}, expected ${PLANU_VERSION}. ` +
17
+ 'Could not determine the native target triple from the artifact build id; run: ' +
18
+ 'bash scripts/build-rust-local.sh --host after manually removing the stale native artifact for your platform.');
19
+ }
20
+ return (`Native artifact reports engineVersion ${artifactVersion}, expected ${PLANU_VERSION}. Run: ` +
21
+ `cargo clean -p planu-core --release --target ${triple} --manifest-path rust/planu-core/Cargo.toml && bash scripts/build-rust-local.sh --host`);
22
+ }
1
23
  export class ValidationReceiptSignerUnavailableError extends Error {
2
24
  reason;
3
25
  code = 'VALIDATION_RECEIPT_SIGNER_UNAVAILABLE';
4
- constructor(reason) {
5
- super(`[Planu] VALIDATION_RECEIPT_SIGNER_UNAVAILABLE:${reason} Restart the MCP host and retry.`);
26
+ constructor(reason, remediation = DEFAULT_REMEDIATION) {
27
+ super(`[Planu] VALIDATION_RECEIPT_SIGNER_UNAVAILABLE:${reason} ${remediation}`);
6
28
  this.reason = reason;
7
29
  this.name = 'ValidationReceiptSignerUnavailableError';
8
30
  }
9
31
  }
10
32
  /** Build the privileged main-thread port only from a canonical, verified native module. */
11
- export function createMacOSKeychainNativePort(platform, overrideDefined, disabled, nativeModule, origin, capabilities) {
33
+ export function createMacOSKeychainNativePort(platform, overrideDefined, disabled, nativeModule, origin, capabilities, compatibility) {
12
34
  if (platform !== 'darwin') {
13
35
  throw new ValidationReceiptSignerUnavailableError('PLATFORM_UNSUPPORTED');
14
36
  }
@@ -19,6 +41,10 @@ export function createMacOSKeychainNativePort(platform, overrideDefined, disable
19
41
  throw new ValidationReceiptSignerUnavailableError('NATIVE_DISABLED');
20
42
  }
21
43
  if (!nativeModule) {
44
+ if (compatibility && !compatibility.compatible) {
45
+ const artifactVersion = compatibility.handshake?.engineVersion ?? 'unknown';
46
+ throw new ValidationReceiptSignerUnavailableError('STALE_ARTIFACT', staleArtifactRemediation(artifactVersion, compatibility.handshake?.buildId));
47
+ }
22
48
  throw new ValidationReceiptSignerUnavailableError('ARTIFACT_MISSING');
23
49
  }
24
50
  if (origin !== 'local' && origin !== 'package') {
package/dist/engine/planu-core.darwin-arm64.node.manifest.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-aarch64-apple-darwin",
3
+ "cliVersion": "5.3.20",
4
+ "engineVersion": "5.3.20",
5
+ "buildId": "1-5.3.20-aarch64-apple-darwin",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
17
17
  "platform": "darwin",
18
18
  "arch": "arm64",
19
19
  "libc": null,
20
- "artifactSha256": "1f29dabb50c539571c4cd0faa56ddf0229692c0ec2542a15e9ea9124f9ca74e7",
20
+ "artifactSha256": "e55efda88d366c03c6dedb2c606e5e085f9cb7b4b41950d0a59de891ca8e6e3e",
21
21
  "sbom": {
22
22
  "format": "CycloneDX-1.5",
23
23
  "path": "planu-core.darwin-arm64.node.sbom.json",
24
- "sha256": "620c8503c3912de3e6b75075689ee5b649c8f6be9962bc21fc8276280b09e279"
24
+ "sha256": "c6865313d06acb32d6999c0b56796fbb7f36a6160c9a7f42ad2c9c25e354cfda"
25
25
  },
26
26
  "provenance": {
27
27
  "builder": "scripts/build-rust-local.sh",
28
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
28
+ "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
29
29
  "sourceTreeDirty": false,
30
30
  "sourceDateEpoch": 1,
31
31
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
34
34
  "signature": {
35
35
  "algorithm": "Ed25519",
36
36
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
37
- "value": "k9AVxzI04bgfuND1J5nY8MpjxvR6HhT3NGf79eXCj3e0LPkesc0thPA18JeZhiSV7rhHzAG3carMNNCiZ1vfCg=="
37
+ "value": "RUWNdjH6OhhIcCfdfPKR4jrxVbIgSynmnWCV8TAUP8OjP61pcXYBJ3Atoi3dFUbFKe5K5/PdXp0YR+2ypHmoDw=="
38
38
  }
39
39
  }
package/dist/engine/planu-core.darwin-arm64.node.sbom.json CHANGED
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.20",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.20",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "1f29dabb50c539571c4cd0faa56ddf0229692c0ec2542a15e9ea9124f9ca74e7"
14
+ "content": "e55efda88d366c03c6dedb2c606e5e085f9cb7b4b41950d0a59de891ca8e6e3e"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.20",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
package/dist/engine/planu-core.darwin-x64.node.manifest.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-x86_64-apple-darwin",
3
+ "cliVersion": "5.3.20",
4
+ "engineVersion": "5.3.20",
5
+ "buildId": "1-5.3.20-x86_64-apple-darwin",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
17
17
  "platform": "darwin",
18
18
  "arch": "x64",
19
19
  "libc": null,
20
- "artifactSha256": "5bebf7e10b2ee79d20a9ceba9312fbb67cfdd73ab79f95097df688d5a265d2e5",
20
+ "artifactSha256": "f5b0bc55a024310b90e4273fee8302401e2ec83006a4410c95dadf087262ef87",
21
21
  "sbom": {
22
22
  "format": "CycloneDX-1.5",
23
23
  "path": "planu-core.darwin-x64.node.sbom.json",
24
- "sha256": "e089459f8b41d8a9ef8c0e64c5a9b6d862f693c8b1db0cb3415471bf96051f38"
24
+ "sha256": "eed96de149c1340631b052fe4561bd8a768e39ae29ffca54d715183c2e4756da"
25
25
  },
26
26
  "provenance": {
27
27
  "builder": "scripts/build-rust-local.sh",
28
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
28
+ "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
29
29
  "sourceTreeDirty": false,
30
30
  "sourceDateEpoch": 1,
31
31
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
34
34
  "signature": {
35
35
  "algorithm": "Ed25519",
36
36
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
37
- "value": "RoGPcSKkwm8KAccKoWPJDVP4us/idkZTkcoEGHIppoLstMsOhsul77ttEVUimGQQGwW3dEsgPYbppsHiRqBDDA=="
37
+ "value": "47S1SX1cvHc/E2jHlD7Mhagd3CiGdWbCdLiJmCFsCqP9yEWYBCkgw/jZoT3qUgTmExse+Hvzx8LDBc9fZl3RAA=="
38
38
  }
39
39
  }
package/dist/engine/planu-core.darwin-x64.node.sbom.json CHANGED
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.20",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.20",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "5bebf7e10b2ee79d20a9ceba9312fbb67cfdd73ab79f95097df688d5a265d2e5"
14
+ "content": "f5b0bc55a024310b90e4273fee8302401e2ec83006a4410c95dadf087262ef87"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.20",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-aarch64-unknown-linux-gnu",
3
+ "cliVersion": "5.3.20",
4
+ "engineVersion": "5.3.20",
5
+ "buildId": "1-5.3.20-aarch64-unknown-linux-gnu",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
16
16
  "platform": "linux",
17
17
  "arch": "arm64",
18
18
  "libc": "glibc",
19
- "artifactSha256": "3bae36e956b7ae1000706731713917fdaa24c65ae12907b6852eba1a705accac",
19
+ "artifactSha256": "2ea9228381585e0867fa1744ce15a50a1406217925c18d61ca86ef46045ab341",
20
20
  "sbom": {
21
21
  "format": "CycloneDX-1.5",
22
22
  "path": "planu-core.linux-arm64-gnu.node.sbom.json",
23
- "sha256": "171d4acf8dccf16b0bf0748ed4fed01a9448fa43a4e50deb007b3cd52185feac"
23
+ "sha256": "8dfab3a92f1a20f69d26ab5bcd73cd218b622a82ed02c7bc6cc9c800937b9696"
24
24
  },
25
25
  "provenance": {
26
26
  "builder": "scripts/build-rust-local.sh",
27
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
27
+ "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
28
28
  "sourceTreeDirty": false,
29
29
  "sourceDateEpoch": 1,
30
30
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
33
33
  "signature": {
34
34
  "algorithm": "Ed25519",
35
35
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
36
- "value": "XxTKMBfrdh1tWiGdgZ4bKrI8Ky5c/nP/vuxbK7EC1Aq+YZtioEgCgfBdBI5w4uyw8p1GXoBBhQx9fTIq2pL0Bg=="
36
+ "value": "yOcMzbe+aaTbIFqSbUKv5azScjk4Fs/e2th78DhaQdP287O5UOsGxxhv5w54gmwB//Lm6tXdzgbWK77g37SbAg=="
37
37
  }
38
38
  }
package/dist/engine/planu-core.linux-arm64-gnu.node.sbom.json CHANGED
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.20",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.20",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "3bae36e956b7ae1000706731713917fdaa24c65ae12907b6852eba1a705accac"
14
+ "content": "2ea9228381585e0867fa1744ce15a50a1406217925c18d61ca86ef46045ab341"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.20",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
package/dist/engine/planu-core.linux-arm64-musl.node.manifest.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-aarch64-unknown-linux-musl",
3
+ "cliVersion": "5.3.20",
4
+ "engineVersion": "5.3.20",
5
+ "buildId": "1-5.3.20-aarch64-unknown-linux-musl",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
16
16
  "platform": "linux",
17
17
  "arch": "arm64",
18
18
  "libc": "musl",
19
- "artifactSha256": "b8ea8cacc4350859fd4fb3bd81c6101e649137c65b6bb5440909bb51d0c37fcb",
19
+ "artifactSha256": "820652ed60481ecf6291c64f2a2720d52410bd06b27268b24881e95f45ac4fb5",
20
20
  "sbom": {
21
21
  "format": "CycloneDX-1.5",
22
22
  "path": "planu-core.linux-arm64-musl.node.sbom.json",
23
- "sha256": "fd28a7413c135a39576a1056a5deead78338371e8073fd20b6abd199845411a2"
23
+ "sha256": "709feb9088507693ac37ea745921e1f93ff3e1d342fb376ba3f7bb7e900d7799"
24
24
  },
25
25
  "provenance": {
26
26
  "builder": "scripts/build-rust-local.sh",
27
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
27
+ "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
28
28
  "sourceTreeDirty": false,
29
29
  "sourceDateEpoch": 1,
30
30
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
33
33
  "signature": {
34
34
  "algorithm": "Ed25519",
35
35
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
36
- "value": "o7uTG1xKYJ+riU+mv007RF+WYaEjDsRaO4IZcSe5WPixwGPpRWvwlpLfR48jcAq3WvnLl2a4mgV32OJNiFgRCw=="
36
+ "value": "Clj0B7s1KmADZoERbK4C9DcJX3Y7B4572h/Key3t6oDNEdqIbaff4XJ47TIBTuDW1RICr5myVcQJQlOL1m+oDA=="
37
37
  }
38
38
  }
package/dist/engine/planu-core.linux-arm64-musl.node.sbom.json CHANGED
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.20",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.20",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "b8ea8cacc4350859fd4fb3bd81c6101e649137c65b6bb5440909bb51d0c37fcb"
14
+ "content": "820652ed60481ecf6291c64f2a2720d52410bd06b27268b24881e95f45ac4fb5"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.20",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
package/dist/engine/planu-core.linux-x64-gnu.node.manifest.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-x86_64-unknown-linux-gnu",
3
+ "cliVersion": "5.3.20",
4
+ "engineVersion": "5.3.20",
5
+ "buildId": "1-5.3.20-x86_64-unknown-linux-gnu",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
16
16
  "platform": "linux",
17
17
  "arch": "x64",
18
18
  "libc": "glibc",
19
- "artifactSha256": "24e74e2c669c2a68b3b35874d6bd65d2b22c51ecc308dde4e203727b45af34ac",
19
+ "artifactSha256": "480558ee13c36ac1382a265cb156eb9f966ded72e144a209052e7098ee61af47",
20
20
  "sbom": {
21
21
  "format": "CycloneDX-1.5",
22
22
  "path": "planu-core.linux-x64-gnu.node.sbom.json",
23
- "sha256": "276a8cafd588761c52939bb47de450d95227b6059768760f20a8897ca4738f3e"
23
+ "sha256": "4ad75195c8a05b860c309208c7ad45361c0eea7cc107d85500805e93ce04e687"
24
24
  },
25
25
  "provenance": {
26
26
  "builder": "scripts/build-rust-local.sh",
27
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
27
+ "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
28
28
  "sourceTreeDirty": false,
29
29
  "sourceDateEpoch": 1,
30
30
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
33
33
  "signature": {
34
34
  "algorithm": "Ed25519",
35
35
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
36
- "value": "y2qW0O1YsGy1zVa9o85ZsxfAkvkMH1qez8hihVbF2HSoeDoZCKpHBEC3gODewKem4FcerHydbf22hJzw8fQ7Ag=="
36
+ "value": "j6srf3XwnCHHrmF00S8IerExJd/Pov1K9oInF/jL/PkhGnknti6GYgm73GxfryUBK5FrsT7nTWXqXrmY2GHQDw=="
37
37
  }
38
38
  }
package/dist/engine/planu-core.linux-x64-gnu.node.sbom.json CHANGED
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.20",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.20",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "24e74e2c669c2a68b3b35874d6bd65d2b22c51ecc308dde4e203727b45af34ac"
14
+ "content": "480558ee13c36ac1382a265cb156eb9f966ded72e144a209052e7098ee61af47"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.20",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
package/dist/engine/planu-core.linux-x64-musl.node.manifest.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-x86_64-unknown-linux-musl",
3
+ "cliVersion": "5.3.20",
4
+ "engineVersion": "5.3.20",
5
+ "buildId": "1-5.3.20-x86_64-unknown-linux-musl",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
16
16
  "platform": "linux",
17
17
  "arch": "x64",
18
18
  "libc": "musl",
19
- "artifactSha256": "bcf8d3bb268ed20fe1c1b2619e284445303c049108270dc594904f4c962dfd5d",
19
+ "artifactSha256": "4d49cab5c5a4acd877e594cab33c0aa0c2a1e3cc153598d500491c7980415d8e",
20
20
  "sbom": {
21
21
  "format": "CycloneDX-1.5",
22
22
  "path": "planu-core.linux-x64-musl.node.sbom.json",
23
- "sha256": "95d23130209a76b4f1110c40e0a80480edc7e01470b0a8022b486e169ade12dd"
23
+ "sha256": "0df31770a702f024c54991719dc402e0c581652cac146a389fb03d1322d40456"
24
24
  },
25
25
  "provenance": {
26
26
  "builder": "scripts/build-rust-local.sh",
27
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
27
+ "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
28
28
  "sourceTreeDirty": false,
29
29
  "sourceDateEpoch": 1,
30
30
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
33
33
  "signature": {
34
34
  "algorithm": "Ed25519",
35
35
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
36
- "value": "n8r1wcRsd2/3j03/G6HQsvBfozDUGYh4r2um6IJY9Lt9fi8DjmQZh8tTDxkIN4AspCa7+ZzLv2w7xGSHd4CnCw=="
36
+ "value": "KYrdMvuUvSOezgBWK84rqhv4NstKjCq4f0iEoe2E6h3iV2e2uDhXT5WQyXeeV+9/fNKLKfTcSkepeSW1347YDg=="
37
37
  }
38
38
  }
package/dist/engine/planu-core.linux-x64-musl.node.sbom.json CHANGED
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.20",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.20",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "bcf8d3bb268ed20fe1c1b2619e284445303c049108270dc594904f4c962dfd5d"
14
+ "content": "4d49cab5c5a4acd877e594cab33c0aa0c2a1e3cc153598d500491c7980415d8e"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.20",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
package/dist/engine/planu-core.win32-arm64-msvc.node.manifest.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-aarch64-pc-windows-msvc",
3
+ "cliVersion": "5.3.20",
4
+ "engineVersion": "5.3.20",
5
+ "buildId": "1-5.3.20-aarch64-pc-windows-msvc",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
16
16
  "platform": "win32",
17
17
  "arch": "arm64",
18
18
  "libc": null,
19
- "artifactSha256": "cd4ce0597447372d8e88d0e4f64e02d249691e956775f7f37d5688f0f5bb2c96",
19
+ "artifactSha256": "af8d4bc6ff629838c2dc4ec1585fddb34ff746c7a655d17f330d1f948a9f88fa",
20
20
  "sbom": {
21
21
  "format": "CycloneDX-1.5",
22
22
  "path": "planu-core.win32-arm64-msvc.node.sbom.json",
23
- "sha256": "e6d80cbdbac2a647206fa053b628d045a5529393cb44821d67cd35e569ced76d"
23
+ "sha256": "cb68d92f6c73d1a1761d6bf3dca51cd2d7ed4c777eaf21bbabaa10bd860c5bb1"
24
24
  },
25
25
  "provenance": {
26
26
  "builder": "scripts/build-rust-local.sh",
27
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
27
+ "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
28
28
  "sourceTreeDirty": false,
29
29
  "sourceDateEpoch": 1,
30
30
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
33
33
  "signature": {
34
34
  "algorithm": "Ed25519",
35
35
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
36
- "value": "Q6ts91GmwqdSwLe1GvNRHFSsCGykhIzWc5O3IwpHnNZFfDz3LTH2Ja0Fxb/k7FSHpz4UyYnmPt3HwB/6j7y/AQ=="
36
+ "value": "Es/39B5KADPs6wEf4GX2YjN5WA+nqJzGHtltz8VoVS6dsSJKFVKX3RfHiVSldTAv7Lw1k+A+MfmVbarQX3yYBA=="
37
37
  }
38
38
  }
package/dist/engine/planu-core.win32-arm64-msvc.node.sbom.json CHANGED
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.20",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.20",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "cd4ce0597447372d8e88d0e4f64e02d249691e956775f7f37d5688f0f5bb2c96"
14
+ "content": "af8d4bc6ff629838c2dc4ec1585fddb34ff746c7a655d17f330d1f948a9f88fa"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.20",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
package/dist/engine/planu-core.win32-x64-msvc.node.manifest.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-x86_64-pc-windows-msvc",
3
+ "cliVersion": "5.3.20",
4
+ "engineVersion": "5.3.20",
5
+ "buildId": "1-5.3.20-x86_64-pc-windows-msvc",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
16
16
  "platform": "win32",
17
17
  "arch": "x64",
18
18
  "libc": null,
19
- "artifactSha256": "52f66ae85f8307c276934133b19976072b258cdb4f94d961d57576236ab3022c",
19
+ "artifactSha256": "662110578e520cfda4c20f3e99b3ae02f12b62fe4af3df0ddca993137144ec4c",
20
20
  "sbom": {
21
21
  "format": "CycloneDX-1.5",
22
22
  "path": "planu-core.win32-x64-msvc.node.sbom.json",
23
- "sha256": "bb2a21e048c3c9eaa0b97a637028c4380383188ea5250744970b5e7e7951deb1"
23
+ "sha256": "2a840b84b97ba7dcce0240fb82033dd2a88d4d9db4698ac7a0e75802f0093154"
24
24
  },
25
25
  "provenance": {
26
26
  "builder": "scripts/build-rust-local.sh",
27
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
27
+ "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
28
28
  "sourceTreeDirty": false,
29
29
  "sourceDateEpoch": 1,
30
30
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
33
33
  "signature": {
34
34
  "algorithm": "Ed25519",
35
35
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
36
- "value": "gP3XXy5qnghDAD21CrkLi1sw/adG+TqD1e/bxdAucDMc9+piwOyosQZe3+Ou/wYTZKgZddL2iZnHJzUA1FlDAA=="
36
+ "value": "RzsxC6qOLporNXgL8gFU0tSNJPRYuKZE4N5Afi7vixhyzHtW5e96Afpv608/uvuEaPXiFBwbQPSVa7Ev9jlDAg=="
37
37
  }
38
38
  }
package/dist/engine/planu-core.win32-x64-msvc.node.sbom.json CHANGED
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.20",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.20",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "52f66ae85f8307c276934133b19976072b258cdb4f94d961d57576236ab3022c"
14
+ "content": "662110578e520cfda4c20f3e99b3ae02f12b62fe4af3df0ddca993137144ec4c"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.20",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
package/dist/tools/check-readiness.js CHANGED
@@ -8,6 +8,13 @@ const MAX_VISIBLE_BLOCKERS = 8;
8
8
  const MAX_VISIBLE_WARNINGS = 8;
9
9
  const MAX_VISIBLE_RECOMMENDATIONS = 5;
10
10
  const CANONICAL_CRITERIA_MISSING = 'CANONICAL_CRITERIA_MISSING';
11
+ const OUT_OF_SCOPE_SECTION_PATH = 'body.out_of_scope';
12
+ const SPEC_PATH_FIELD = 'specPath';
13
+ function scopeBoundariesUnverified(validationResult) {
14
+ const specUnreadable = validationResult.errors.some((error) => error.code === 'MISSING_FRONTMATTER' && error.path === SPEC_PATH_FIELD);
15
+ const outOfScopeSectionAbsent = validationResult.warnings.some((warning) => warning.code === 'OPTIONAL_SECTION_MISSING' && warning.path === OUT_OF_SCOPE_SECTION_PATH);
16
+ return specUnreadable || outOfScopeSectionAbsent;
17
+ }
11
18
  function formatScore(score) {
12
19
  if (score >= 90) {
13
20
  return `${score}/100 (Excellent)`;
@@ -166,8 +173,7 @@ export async function handleCheckReadiness(args) {
166
173
  // canonical validation result as an implementation-ready pass.
167
174
  report.ready = false;
168
175
  }
169
- // SPEC-612: recommend adding outOfScope items when none are declared
170
- if (spec.outOfScope === undefined || spec.outOfScope.length === 0) {
176
+ if (scopeBoundariesUnverified(vr)) {
171
177
  report.recommendations.push('Add outOfScope items to the spec frontmatter to declare explicit scope boundaries (SPEC-612). This reduces scope creep during implementation.');
172
178
  }
173
179
  const qualityScore = vr.qualityReport?.score;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@planu/cli",
3
- "version": "5.3.19",
3
+ "version": "5.3.20",
4
4
  "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
@@ -35,14 +35,14 @@
35
35
  "packageName": "@planu/core"
36
36
  },
37
37
  "optionalDependencies": {
38
- "@planu/core-darwin-arm64": "5.3.19",
39
- "@planu/core-darwin-x64": "5.3.19",
40
- "@planu/core-linux-arm64-gnu": "5.3.19",
41
- "@planu/core-linux-arm64-musl": "5.3.19",
42
- "@planu/core-linux-x64-gnu": "5.3.19",
43
- "@planu/core-linux-x64-musl": "5.3.19",
44
- "@planu/core-win32-arm64-msvc": "5.3.19",
45
- "@planu/core-win32-x64-msvc": "5.3.19"
38
+ "@planu/core-darwin-arm64": "5.3.20",
39
+ "@planu/core-darwin-x64": "5.3.20",
40
+ "@planu/core-linux-arm64-gnu": "5.3.20",
41
+ "@planu/core-linux-arm64-musl": "5.3.20",
42
+ "@planu/core-linux-x64-gnu": "5.3.20",
43
+ "@planu/core-linux-x64-musl": "5.3.20",
44
+ "@planu/core-win32-arm64-msvc": "5.3.20",
45
+ "@planu/core-win32-x64-msvc": "5.3.20"
46
46
  },
47
47
  "engines": {
48
48
  "node": ">=24.0.0"
package/planu-native.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "dev.planu.native",
3
3
  "displayName": "Planu Native Lightweight Surface",
4
- "version": "5.3.19",
4
+ "version": "5.3.20",
5
5
  "packageName": "@planu/cli",
6
6
  "modes": {
7
7
  "lightweight": {
package/planu-plugin.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "name": "dev.planu.cli",
3
3
  "displayName": "Planu — Spec Driven Development",
4
4
  "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
5
- "version": "5.3.19",
5
+ "version": "5.3.20",
6
6
  "icon": "assets/plugin/icon.svg",
7
7
  "command": ["npx", "@planu/cli@latest"],
8
8
  "packageName": "@planu/cli",