@planu/cli 5.3.19 → 5.3.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (28) hide show
  1. package/CHANGELOG.md +17 -0
  2. package/dist/engine/core-bridge.js +2 -2
  3. package/dist/engine/macos-keychain-native-port.d.ts +4 -4
  4. package/dist/engine/macos-keychain-native-port.js +29 -3
  5. package/dist/engine/planu-core.darwin-arm64.node.manifest.json +7 -7
  6. package/dist/engine/planu-core.darwin-arm64.node.sbom.json +4 -4
  7. package/dist/engine/planu-core.darwin-x64.node.manifest.json +7 -7
  8. package/dist/engine/planu-core.darwin-x64.node.sbom.json +4 -4
  9. package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json +7 -7
  10. package/dist/engine/planu-core.linux-arm64-gnu.node.sbom.json +4 -4
  11. package/dist/engine/planu-core.linux-arm64-musl.node.manifest.json +7 -7
  12. package/dist/engine/planu-core.linux-arm64-musl.node.sbom.json +4 -4
  13. package/dist/engine/planu-core.linux-x64-gnu.node.manifest.json +7 -7
  14. package/dist/engine/planu-core.linux-x64-gnu.node.sbom.json +4 -4
  15. package/dist/engine/planu-core.linux-x64-musl.node.manifest.json +7 -7
  16. package/dist/engine/planu-core.linux-x64-musl.node.sbom.json +4 -4
  17. package/dist/engine/planu-core.win32-arm64-msvc.node.manifest.json +7 -7
  18. package/dist/engine/planu-core.win32-arm64-msvc.node.sbom.json +4 -4
  19. package/dist/engine/planu-core.win32-x64-msvc.node.manifest.json +7 -7
  20. package/dist/engine/planu-core.win32-x64-msvc.node.sbom.json +4 -4
  21. package/dist/engine/universal-rules/rules/planu-release-policy.js +2 -1
  22. package/dist/resources/process.js +1 -1
  23. package/dist/tools/check-readiness.js +8 -2
  24. package/dist/tools/create-spec.js +21 -9
  25. package/package.json +11 -9
  26. package/planu-native.json +1 -1
  27. package/planu-plugin.json +1 -1
  28. package/scripts/lib/portable-paths.mjs +54 -0
package/CHANGELOG.md CHANGED
@@ -1,3 +1,20 @@
1
+ ## [5.3.21] - 2026-08-12
2
+
3
+ ### Bug Fixes
4
+ - fix(spec-1499,spec-1500): portable path redaction and a cheap pre-flight gate
5
+
6
+ ### Chores
7
+ - chore(planu): refresh session context after SPEC-1505 intake
8
+
9
+
10
+ ## [5.3.20] - 2026-08-12
11
+
12
+ ### Bug Fixes
13
+ - fix(release): unblock validate and privacy gates for v5.3.20
14
+ - fix(spec-1495): ground the outOfScope recommendation in the spec document
15
+ - fix(spec-1483): fail the native build on a version-mismatched artifact
16
+
17
+
1
18
  ## [5.3.19] - 2026-08-11
2
19
 
3
20
  ### Bug Fixes
@@ -187,7 +187,7 @@ function loadNative() {
187
187
  return mod;
188
188
  }
189
189
  }
190
- loadDiagnostic = { attempted: attempts, errors };
190
+ loadDiagnostic = { ...loadDiagnostic, attempted: attempts, errors };
191
191
  return null;
192
192
  }
193
193
  function refreshNativeCapabilityDiagnostic() {
@@ -223,7 +223,7 @@ export function requireMacOSKeychainNativePort() {
223
223
  const keychainNative = loadNative();
224
224
  refreshNativeCapabilityDiagnostic();
225
225
  return createMacOSKeychainNativePort(process.platform, process.env.PLANU_NATIVE_PATH !== undefined ||
226
- process.env.NAPI_RS_NATIVE_LIBRARY_PATH !== undefined, process.env.DISABLE_NATIVE_CORE === '1', keychainNative, loadDiagnostic.origin, loadDiagnostic.compatibility?.handshake?.capabilities);
226
+ process.env.NAPI_RS_NATIVE_LIBRARY_PATH !== undefined, process.env.DISABLE_NATIVE_CORE === '1', keychainNative, loadDiagnostic.origin, loadDiagnostic.compatibility?.handshake?.capabilities, loadDiagnostic.compatibility);
227
227
  }
228
228
  // TypeScript fallbacks -------------------------------------------------------
229
229
  // These keep the surface area working when the native binary is unavailable
@@ -1,10 +1,10 @@
1
- import type { PlanuCore } from '../types/core-bridge.js';
1
+ import type { NativeRuntimeCompatibility, PlanuCore } from '../types/core-bridge.js';
2
2
  import type { MacOSKeychainNativePort } from '../types/security.js';
3
3
  export declare class ValidationReceiptSignerUnavailableError extends Error {
4
- readonly reason: 'PLATFORM_UNSUPPORTED' | 'NATIVE_DISABLED' | 'ARTIFACT_MISSING' | 'NONCANONICAL_ORIGIN' | 'CAPABILITY_MISSING' | 'PORT_INCOMPLETE' | 'OVERRIDE_REJECTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE';
4
+ readonly reason: 'PLATFORM_UNSUPPORTED' | 'NATIVE_DISABLED' | 'ARTIFACT_MISSING' | 'STALE_ARTIFACT' | 'NONCANONICAL_ORIGIN' | 'CAPABILITY_MISSING' | 'PORT_INCOMPLETE' | 'OVERRIDE_REJECTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE';
5
5
  readonly code: 'VALIDATION_RECEIPT_SIGNER_UNAVAILABLE';
6
- constructor(reason: 'PLATFORM_UNSUPPORTED' | 'NATIVE_DISABLED' | 'ARTIFACT_MISSING' | 'NONCANONICAL_ORIGIN' | 'CAPABILITY_MISSING' | 'PORT_INCOMPLETE' | 'OVERRIDE_REJECTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE');
6
+ constructor(reason: 'PLATFORM_UNSUPPORTED' | 'NATIVE_DISABLED' | 'ARTIFACT_MISSING' | 'STALE_ARTIFACT' | 'NONCANONICAL_ORIGIN' | 'CAPABILITY_MISSING' | 'PORT_INCOMPLETE' | 'OVERRIDE_REJECTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE', remediation?: string);
7
7
  }
8
8
  /** Build the privileged main-thread port only from a canonical, verified native module. */
9
- export declare function createMacOSKeychainNativePort(platform: NodeJS.Platform, overrideDefined: boolean, disabled: boolean, nativeModule: PlanuCore | null, origin: 'override' | 'local' | 'package' | undefined, capabilities: readonly string[] | undefined): MacOSKeychainNativePort;
9
+ export declare function createMacOSKeychainNativePort(platform: NodeJS.Platform, overrideDefined: boolean, disabled: boolean, nativeModule: PlanuCore | null, origin: 'override' | 'local' | 'package' | undefined, capabilities: readonly string[] | undefined, compatibility?: NativeRuntimeCompatibility): MacOSKeychainNativePort;
10
10
  //# sourceMappingURL=macos-keychain-native-port.d.ts.map
@@ -1,14 +1,36 @@
1
+ import { PLANU_VERSION } from '../config/version.js';
2
+ const DEFAULT_REMEDIATION = 'Restart the MCP host and retry.';
3
+ /** Recover the native target triple from a buildId shaped `<epoch>-<engineVersion>-<triple>`. */
4
+ function deriveNativeTargetTriple(buildId, engineVersion) {
5
+ const separator = `-${engineVersion}-`;
6
+ const index = buildId.indexOf(separator);
7
+ if (index === -1) {
8
+ return null;
9
+ }
10
+ const triple = buildId.slice(index + separator.length);
11
+ return triple.length > 0 ? triple : null;
12
+ }
13
+ function staleArtifactRemediation(artifactVersion, buildId) {
14
+ const triple = buildId ? deriveNativeTargetTriple(buildId, artifactVersion) : null;
15
+ if (!triple) {
16
+ return (`Native artifact reports engineVersion ${artifactVersion}, expected ${PLANU_VERSION}. ` +
17
+ 'Could not determine the native target triple from the artifact build id; run: ' +
18
+ 'bash scripts/build-rust-local.sh --host after manually removing the stale native artifact for your platform.');
19
+ }
20
+ return (`Native artifact reports engineVersion ${artifactVersion}, expected ${PLANU_VERSION}. Run: ` +
21
+ `cargo clean -p planu-core --release --target ${triple} --manifest-path rust/planu-core/Cargo.toml && bash scripts/build-rust-local.sh --host`);
22
+ }
1
23
  export class ValidationReceiptSignerUnavailableError extends Error {
2
24
  reason;
3
25
  code = 'VALIDATION_RECEIPT_SIGNER_UNAVAILABLE';
4
- constructor(reason) {
5
- super(`[Planu] VALIDATION_RECEIPT_SIGNER_UNAVAILABLE:${reason} Restart the MCP host and retry.`);
26
+ constructor(reason, remediation = DEFAULT_REMEDIATION) {
27
+ super(`[Planu] VALIDATION_RECEIPT_SIGNER_UNAVAILABLE:${reason} ${remediation}`);
6
28
  this.reason = reason;
7
29
  this.name = 'ValidationReceiptSignerUnavailableError';
8
30
  }
9
31
  }
10
32
  /** Build the privileged main-thread port only from a canonical, verified native module. */
11
- export function createMacOSKeychainNativePort(platform, overrideDefined, disabled, nativeModule, origin, capabilities) {
33
+ export function createMacOSKeychainNativePort(platform, overrideDefined, disabled, nativeModule, origin, capabilities, compatibility) {
12
34
  if (platform !== 'darwin') {
13
35
  throw new ValidationReceiptSignerUnavailableError('PLATFORM_UNSUPPORTED');
14
36
  }
@@ -19,6 +41,10 @@ export function createMacOSKeychainNativePort(platform, overrideDefined, disable
19
41
  throw new ValidationReceiptSignerUnavailableError('NATIVE_DISABLED');
20
42
  }
21
43
  if (!nativeModule) {
44
+ if (compatibility && !compatibility.compatible) {
45
+ const artifactVersion = compatibility.handshake?.engineVersion ?? 'unknown';
46
+ throw new ValidationReceiptSignerUnavailableError('STALE_ARTIFACT', staleArtifactRemediation(artifactVersion, compatibility.handshake?.buildId));
47
+ }
22
48
  throw new ValidationReceiptSignerUnavailableError('ARTIFACT_MISSING');
23
49
  }
24
50
  if (origin !== 'local' && origin !== 'package') {
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-aarch64-apple-darwin",
3
+ "cliVersion": "5.3.21",
4
+ "engineVersion": "5.3.21",
5
+ "buildId": "1-5.3.21-aarch64-apple-darwin",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
17
17
  "platform": "darwin",
18
18
  "arch": "arm64",
19
19
  "libc": null,
20
- "artifactSha256": "1f29dabb50c539571c4cd0faa56ddf0229692c0ec2542a15e9ea9124f9ca74e7",
20
+ "artifactSha256": "5d0ff6b13b11d1d071a61c8211bc7b65453a8f8b42a1e7fe53d3d1c073980e02",
21
21
  "sbom": {
22
22
  "format": "CycloneDX-1.5",
23
23
  "path": "planu-core.darwin-arm64.node.sbom.json",
24
- "sha256": "620c8503c3912de3e6b75075689ee5b649c8f6be9962bc21fc8276280b09e279"
24
+ "sha256": "b81e5b05dc2ff4921b39f56e4bae1e469d71216fbb9e4a20275d756197d75641"
25
25
  },
26
26
  "provenance": {
27
27
  "builder": "scripts/build-rust-local.sh",
28
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
28
+ "sourceCommit": "bedb8918a453fd7e20e704054f42f91211240a89",
29
29
  "sourceTreeDirty": false,
30
30
  "sourceDateEpoch": 1,
31
31
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
34
34
  "signature": {
35
35
  "algorithm": "Ed25519",
36
36
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
37
- "value": "k9AVxzI04bgfuND1J5nY8MpjxvR6HhT3NGf79eXCj3e0LPkesc0thPA18JeZhiSV7rhHzAG3carMNNCiZ1vfCg=="
37
+ "value": "HRtAs/3Ma0OGaM9v+KVToQwspvBMKMKJWkE5Go3rkhNXRBwb7IbEsBKlD4gqWLGmVd49uOxpLnRy1PxNo+GqBQ=="
38
38
  }
39
39
  }
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.21",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.21",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "1f29dabb50c539571c4cd0faa56ddf0229692c0ec2542a15e9ea9124f9ca74e7"
14
+ "content": "5d0ff6b13b11d1d071a61c8211bc7b65453a8f8b42a1e7fe53d3d1c073980e02"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.21",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-x86_64-apple-darwin",
3
+ "cliVersion": "5.3.21",
4
+ "engineVersion": "5.3.21",
5
+ "buildId": "1-5.3.21-x86_64-apple-darwin",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
17
17
  "platform": "darwin",
18
18
  "arch": "x64",
19
19
  "libc": null,
20
- "artifactSha256": "5bebf7e10b2ee79d20a9ceba9312fbb67cfdd73ab79f95097df688d5a265d2e5",
20
+ "artifactSha256": "e3af2d3036901b1778b46508e77170ddfef0cbc09cc2fb09d29c223d06779154",
21
21
  "sbom": {
22
22
  "format": "CycloneDX-1.5",
23
23
  "path": "planu-core.darwin-x64.node.sbom.json",
24
- "sha256": "e089459f8b41d8a9ef8c0e64c5a9b6d862f693c8b1db0cb3415471bf96051f38"
24
+ "sha256": "bd6287e7353ae8709d9876a1cfcea2a4718354b23d32ae86716dd9da0a38f9e8"
25
25
  },
26
26
  "provenance": {
27
27
  "builder": "scripts/build-rust-local.sh",
28
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
28
+ "sourceCommit": "bedb8918a453fd7e20e704054f42f91211240a89",
29
29
  "sourceTreeDirty": false,
30
30
  "sourceDateEpoch": 1,
31
31
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
34
34
  "signature": {
35
35
  "algorithm": "Ed25519",
36
36
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
37
- "value": "RoGPcSKkwm8KAccKoWPJDVP4us/idkZTkcoEGHIppoLstMsOhsul77ttEVUimGQQGwW3dEsgPYbppsHiRqBDDA=="
37
+ "value": "MZGaYaJeFNHlC7jAh7+bMWMJNofvy7/ekl5xdw0az+E0uoZ8ykviCSqdyeEnhRxkR6/wDTcLdltd7UzwNlSAAw=="
38
38
  }
39
39
  }
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.21",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.21",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "5bebf7e10b2ee79d20a9ceba9312fbb67cfdd73ab79f95097df688d5a265d2e5"
14
+ "content": "e3af2d3036901b1778b46508e77170ddfef0cbc09cc2fb09d29c223d06779154"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.21",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-aarch64-unknown-linux-gnu",
3
+ "cliVersion": "5.3.21",
4
+ "engineVersion": "5.3.21",
5
+ "buildId": "1-5.3.21-aarch64-unknown-linux-gnu",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
16
16
  "platform": "linux",
17
17
  "arch": "arm64",
18
18
  "libc": "glibc",
19
- "artifactSha256": "3bae36e956b7ae1000706731713917fdaa24c65ae12907b6852eba1a705accac",
19
+ "artifactSha256": "7fb817e968e4e81ba34be0892ac79ede2e0aa242e925cca3fe8679250605aa54",
20
20
  "sbom": {
21
21
  "format": "CycloneDX-1.5",
22
22
  "path": "planu-core.linux-arm64-gnu.node.sbom.json",
23
- "sha256": "171d4acf8dccf16b0bf0748ed4fed01a9448fa43a4e50deb007b3cd52185feac"
23
+ "sha256": "8a42027ee50329c7eb8f998216c46fab5af8585a87d16aad4c5bdda12b33b9eb"
24
24
  },
25
25
  "provenance": {
26
26
  "builder": "scripts/build-rust-local.sh",
27
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
27
+ "sourceCommit": "bedb8918a453fd7e20e704054f42f91211240a89",
28
28
  "sourceTreeDirty": false,
29
29
  "sourceDateEpoch": 1,
30
30
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
33
33
  "signature": {
34
34
  "algorithm": "Ed25519",
35
35
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
36
- "value": "XxTKMBfrdh1tWiGdgZ4bKrI8Ky5c/nP/vuxbK7EC1Aq+YZtioEgCgfBdBI5w4uyw8p1GXoBBhQx9fTIq2pL0Bg=="
36
+ "value": "ilcDZiYvq7FNQJ+mGY1o9F6/uXQvC/nt8UMCfidVYkHRHf8QubwKk5UQlBH72YMWNaupYt9eRTJR1sWebfPKDw=="
37
37
  }
38
38
  }
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.21",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.21",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "3bae36e956b7ae1000706731713917fdaa24c65ae12907b6852eba1a705accac"
14
+ "content": "7fb817e968e4e81ba34be0892ac79ede2e0aa242e925cca3fe8679250605aa54"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.21",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-aarch64-unknown-linux-musl",
3
+ "cliVersion": "5.3.21",
4
+ "engineVersion": "5.3.21",
5
+ "buildId": "1-5.3.21-aarch64-unknown-linux-musl",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
16
16
  "platform": "linux",
17
17
  "arch": "arm64",
18
18
  "libc": "musl",
19
- "artifactSha256": "b8ea8cacc4350859fd4fb3bd81c6101e649137c65b6bb5440909bb51d0c37fcb",
19
+ "artifactSha256": "7339b70e762159aa7fc532b986ac8cb08c633fd4ca8c7ae121d13347a84f1a6c",
20
20
  "sbom": {
21
21
  "format": "CycloneDX-1.5",
22
22
  "path": "planu-core.linux-arm64-musl.node.sbom.json",
23
- "sha256": "fd28a7413c135a39576a1056a5deead78338371e8073fd20b6abd199845411a2"
23
+ "sha256": "6dac227097031af87e8e3c135ce415da2001de1bb9157b1f7dbb66204ea5019f"
24
24
  },
25
25
  "provenance": {
26
26
  "builder": "scripts/build-rust-local.sh",
27
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
27
+ "sourceCommit": "bedb8918a453fd7e20e704054f42f91211240a89",
28
28
  "sourceTreeDirty": false,
29
29
  "sourceDateEpoch": 1,
30
30
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
33
33
  "signature": {
34
34
  "algorithm": "Ed25519",
35
35
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
36
- "value": "o7uTG1xKYJ+riU+mv007RF+WYaEjDsRaO4IZcSe5WPixwGPpRWvwlpLfR48jcAq3WvnLl2a4mgV32OJNiFgRCw=="
36
+ "value": "XcWqYU0xSmU4nObgPLy7epaTov4h8+1X/8M45JLz0dsjOZaxm0eMBmp3GWOODR9LUfvRlzCVBL5RCEhp/ndRAg=="
37
37
  }
38
38
  }
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.21",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.21",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "b8ea8cacc4350859fd4fb3bd81c6101e649137c65b6bb5440909bb51d0c37fcb"
14
+ "content": "7339b70e762159aa7fc532b986ac8cb08c633fd4ca8c7ae121d13347a84f1a6c"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.21",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-x86_64-unknown-linux-gnu",
3
+ "cliVersion": "5.3.21",
4
+ "engineVersion": "5.3.21",
5
+ "buildId": "1-5.3.21-x86_64-unknown-linux-gnu",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
16
16
  "platform": "linux",
17
17
  "arch": "x64",
18
18
  "libc": "glibc",
19
- "artifactSha256": "24e74e2c669c2a68b3b35874d6bd65d2b22c51ecc308dde4e203727b45af34ac",
19
+ "artifactSha256": "bec4c162f4a52ed21acae13828cd8c781ec473462f68ab5e0d5eda9bb12802d9",
20
20
  "sbom": {
21
21
  "format": "CycloneDX-1.5",
22
22
  "path": "planu-core.linux-x64-gnu.node.sbom.json",
23
- "sha256": "276a8cafd588761c52939bb47de450d95227b6059768760f20a8897ca4738f3e"
23
+ "sha256": "0d8dc076ab389395ead5ddca3a53d961f97d67945050bc235655e0a9e54261a4"
24
24
  },
25
25
  "provenance": {
26
26
  "builder": "scripts/build-rust-local.sh",
27
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
27
+ "sourceCommit": "bedb8918a453fd7e20e704054f42f91211240a89",
28
28
  "sourceTreeDirty": false,
29
29
  "sourceDateEpoch": 1,
30
30
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
33
33
  "signature": {
34
34
  "algorithm": "Ed25519",
35
35
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
36
- "value": "y2qW0O1YsGy1zVa9o85ZsxfAkvkMH1qez8hihVbF2HSoeDoZCKpHBEC3gODewKem4FcerHydbf22hJzw8fQ7Ag=="
36
+ "value": "GuawhQm5O0s3MXcu4HvaERIaKsh38aEgSY1mPESMfQght82rNpVRH1h3ZKfd30i1gq9OX37u1SBbbQMX1kGsDg=="
37
37
  }
38
38
  }
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.21",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.21",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "24e74e2c669c2a68b3b35874d6bd65d2b22c51ecc308dde4e203727b45af34ac"
14
+ "content": "bec4c162f4a52ed21acae13828cd8c781ec473462f68ab5e0d5eda9bb12802d9"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.21",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-x86_64-unknown-linux-musl",
3
+ "cliVersion": "5.3.21",
4
+ "engineVersion": "5.3.21",
5
+ "buildId": "1-5.3.21-x86_64-unknown-linux-musl",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
16
16
  "platform": "linux",
17
17
  "arch": "x64",
18
18
  "libc": "musl",
19
- "artifactSha256": "bcf8d3bb268ed20fe1c1b2619e284445303c049108270dc594904f4c962dfd5d",
19
+ "artifactSha256": "85e7874f28199b762acb1333c6cda22d35c9edb6a6d7b36ec41f0818e41e4a08",
20
20
  "sbom": {
21
21
  "format": "CycloneDX-1.5",
22
22
  "path": "planu-core.linux-x64-musl.node.sbom.json",
23
- "sha256": "95d23130209a76b4f1110c40e0a80480edc7e01470b0a8022b486e169ade12dd"
23
+ "sha256": "4eb2a14c4032e907fdfb03591f7adb44c9388b818d901b924a5a8634105744e7"
24
24
  },
25
25
  "provenance": {
26
26
  "builder": "scripts/build-rust-local.sh",
27
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
27
+ "sourceCommit": "bedb8918a453fd7e20e704054f42f91211240a89",
28
28
  "sourceTreeDirty": false,
29
29
  "sourceDateEpoch": 1,
30
30
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
33
33
  "signature": {
34
34
  "algorithm": "Ed25519",
35
35
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
36
- "value": "n8r1wcRsd2/3j03/G6HQsvBfozDUGYh4r2um6IJY9Lt9fi8DjmQZh8tTDxkIN4AspCa7+ZzLv2w7xGSHd4CnCw=="
36
+ "value": "AT5DF8UCW6bCBxgX7qjZS0sjS0z311BKwt5AjhBncOJcuHgU84VGvK3nLfgCqbLGwO2ZlaRVKOjBWi5oHAiyBA=="
37
37
  }
38
38
  }
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.21",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.21",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "bcf8d3bb268ed20fe1c1b2619e284445303c049108270dc594904f4c962dfd5d"
14
+ "content": "85e7874f28199b762acb1333c6cda22d35c9edb6a6d7b36ec41f0818e41e4a08"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.21",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-aarch64-pc-windows-msvc",
3
+ "cliVersion": "5.3.21",
4
+ "engineVersion": "5.3.21",
5
+ "buildId": "1-5.3.21-aarch64-pc-windows-msvc",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
16
16
  "platform": "win32",
17
17
  "arch": "arm64",
18
18
  "libc": null,
19
- "artifactSha256": "cd4ce0597447372d8e88d0e4f64e02d249691e956775f7f37d5688f0f5bb2c96",
19
+ "artifactSha256": "6a1e5acdb098a3ac13938e1cf86248650f2b8346cb0d95ad8dc1dca43aa83b16",
20
20
  "sbom": {
21
21
  "format": "CycloneDX-1.5",
22
22
  "path": "planu-core.win32-arm64-msvc.node.sbom.json",
23
- "sha256": "e6d80cbdbac2a647206fa053b628d045a5529393cb44821d67cd35e569ced76d"
23
+ "sha256": "91e7bc68013c5e27e526f0af43d2c187807f291c36190c7e5263f85a0bcce1b2"
24
24
  },
25
25
  "provenance": {
26
26
  "builder": "scripts/build-rust-local.sh",
27
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
27
+ "sourceCommit": "bedb8918a453fd7e20e704054f42f91211240a89",
28
28
  "sourceTreeDirty": false,
29
29
  "sourceDateEpoch": 1,
30
30
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
33
33
  "signature": {
34
34
  "algorithm": "Ed25519",
35
35
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
36
- "value": "Q6ts91GmwqdSwLe1GvNRHFSsCGykhIzWc5O3IwpHnNZFfDz3LTH2Ja0Fxb/k7FSHpz4UyYnmPt3HwB/6j7y/AQ=="
36
+ "value": "iVieTwyF0EA4y4QaoJNSr47cvD1md8w1/VrJoPCEGVoTOPWIPcyEhZRPKMDxnuQRM2Eh0hsQONB4uLSrDcz+Dg=="
37
37
  }
38
38
  }
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.21",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.21",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "cd4ce0597447372d8e88d0e4f64e02d249691e956775f7f37d5688f0f5bb2c96"
14
+ "content": "6a1e5acdb098a3ac13938e1cf86248650f2b8346cb0d95ad8dc1dca43aa83b16"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.21",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
- "cliVersion": "5.3.19",
4
- "engineVersion": "5.3.19",
5
- "buildId": "1-5.3.19-x86_64-pc-windows-msvc",
3
+ "cliVersion": "5.3.21",
4
+ "engineVersion": "5.3.21",
5
+ "buildId": "1-5.3.21-x86_64-pc-windows-msvc",
6
6
  "protocolAbi": 1,
7
7
  "capabilityAbi": 2,
8
8
  "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
16
16
  "platform": "win32",
17
17
  "arch": "x64",
18
18
  "libc": null,
19
- "artifactSha256": "52f66ae85f8307c276934133b19976072b258cdb4f94d961d57576236ab3022c",
19
+ "artifactSha256": "4ce52263d47492b6968e36e7d0722c80e785493028d9d524ca6ec24f960b221b",
20
20
  "sbom": {
21
21
  "format": "CycloneDX-1.5",
22
22
  "path": "planu-core.win32-x64-msvc.node.sbom.json",
23
- "sha256": "bb2a21e048c3c9eaa0b97a637028c4380383188ea5250744970b5e7e7951deb1"
23
+ "sha256": "1daa636cf1b98c866795051183f5aea2e3f9110039e2167ade205fbf2b2c6b24"
24
24
  },
25
25
  "provenance": {
26
26
  "builder": "scripts/build-rust-local.sh",
27
- "sourceCommit": "e9af0aeaf88c4328b735fb324d518b1b1804e948",
27
+ "sourceCommit": "bedb8918a453fd7e20e704054f42f91211240a89",
28
28
  "sourceTreeDirty": false,
29
29
  "sourceDateEpoch": 1,
30
30
  "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
33
33
  "signature": {
34
34
  "algorithm": "Ed25519",
35
35
  "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
36
- "value": "gP3XXy5qnghDAD21CrkLi1sw/adG+TqD1e/bxdAucDMc9+piwOyosQZe3+Ou/wYTZKgZddL2iZnHJzUA1FlDAA=="
36
+ "value": "SMqrkN5zMjAiEWYX9KW4TKa94sW/O2fKw5G8b7/4yzDny0SMsQM/VJxgrw4W8aKht1SqKeHYySApm5llGkzGDQ=="
37
37
  }
38
38
  }
@@ -4,14 +4,14 @@
4
4
  "version": 1,
5
5
  "metadata": {
6
6
  "component": {
7
- "bom-ref": "pkg:cargo/planu-core@5.3.19",
7
+ "bom-ref": "pkg:cargo/planu-core@5.3.21",
8
8
  "type": "library",
9
9
  "name": "planu-core",
10
- "version": "5.3.19",
10
+ "version": "5.3.21",
11
11
  "hashes": [
12
12
  {
13
13
  "alg": "SHA-256",
14
- "content": "52f66ae85f8307c276934133b19976072b258cdb4f94d961d57576236ab3022c"
14
+ "content": "4ce52263d47492b6968e36e7d0722c80e785493028d9d524ca6ec24f960b221b"
15
15
  }
16
16
  ]
17
17
  }
@@ -1106,7 +1106,7 @@
1106
1106
  "dependsOn": []
1107
1107
  },
1108
1108
  {
1109
- "ref": "pkg:cargo/planu-core@5.3.19",
1109
+ "ref": "pkg:cargo/planu-core@5.3.21",
1110
1110
  "dependsOn": [
1111
1111
  "pkg:cargo/core-foundation@0.10.1",
1112
1112
  "pkg:cargo/hmac@0.12.1",
@@ -7,7 +7,8 @@ Auto-generated by \`init_project\`. Do not edit manually.
7
7
 
8
8
  When implementation changes are complete and validated, always address release explicitly with a local-first flow:
9
9
 
10
- - canonical local gates: \`pnpm validate\` then \`pnpm check:strict\`
10
+ - canonical local gate: \`pnpm check:preflight\`
11
+ - source-quality evidence binds the exact release commit, so a pre-bump run can never produce a receipt the release will accept; the full source-quality plan runs once, inside the release, after the bump commit exists
11
12
  - canonical local release command: \`pnpm release:local\`
12
13
  - publish externally only when the user has explicitly requested shipping/publishing
13
14
  - use \`main\` as the default release branch; treat \`develop\` as optional gitflow compatibility only when the repository actively uses it
@@ -94,7 +94,7 @@ function getSddProcess() {
94
94
  name: '8. Document & Ship',
95
95
  tools: ['generate_docs', 'generate_docs_site', 'integrate_pm', 'learn_pattern'],
96
96
  description: 'Generate documentation, run the local-first release contract ' +
97
- '(`pnpm validate`, `pnpm check:strict`, `pnpm release:local` when shipping), ' +
97
+ '(`pnpm check:preflight`, `pnpm release:local` when shipping), ' +
98
98
  'sync with project management tools, and learn patterns for future estimations.',
99
99
  },
100
100
  ],
@@ -8,6 +8,13 @@ const MAX_VISIBLE_BLOCKERS = 8;
8
8
  const MAX_VISIBLE_WARNINGS = 8;
9
9
  const MAX_VISIBLE_RECOMMENDATIONS = 5;
10
10
  const CANONICAL_CRITERIA_MISSING = 'CANONICAL_CRITERIA_MISSING';
11
+ const OUT_OF_SCOPE_SECTION_PATH = 'body.out_of_scope';
12
+ const SPEC_PATH_FIELD = 'specPath';
13
+ function scopeBoundariesUnverified(validationResult) {
14
+ const specUnreadable = validationResult.errors.some((error) => error.code === 'MISSING_FRONTMATTER' && error.path === SPEC_PATH_FIELD);
15
+ const outOfScopeSectionAbsent = validationResult.warnings.some((warning) => warning.code === 'OPTIONAL_SECTION_MISSING' && warning.path === OUT_OF_SCOPE_SECTION_PATH);
16
+ return specUnreadable || outOfScopeSectionAbsent;
17
+ }
11
18
  function formatScore(score) {
12
19
  if (score >= 90) {
13
20
  return `${score}/100 (Excellent)`;
@@ -166,8 +173,7 @@ export async function handleCheckReadiness(args) {
166
173
  // canonical validation result as an implementation-ready pass.
167
174
  report.ready = false;
168
175
  }
169
- // SPEC-612: recommend adding outOfScope items when none are declared
170
- if (spec.outOfScope === undefined || spec.outOfScope.length === 0) {
176
+ if (scopeBoundariesUnverified(vr)) {
171
177
  report.recommendations.push('Add outOfScope items to the spec frontmatter to declare explicit scope boundaries (SPEC-612). This reduces scope creep during implementation.');
172
178
  }
173
179
  const qualityScore = vr.qualityReport?.score;
@@ -41,6 +41,7 @@ import { OperationJournal, recoverOperationJournal, } from '../engine/execution/
41
41
  import { assertExecutionCanCommit } from '../engine/execution/context.js';
42
42
  import { cleanupExecutionArtifact, executionLink, executionMkdir, executionRemove, executionRename, executionWriteFileExclusive, } from '../engine/execution/deadline-io.js';
43
43
  import { atomicWriteFile } from '../engine/safety/atomic-write-file.js';
44
+ import { redactPortablePaths } from '../../scripts/lib/portable-paths.mjs';
44
45
  /** SPEC-584: Persist a clarification token when interactive questions are emitted. Best-effort. */
45
46
  async function persistClarificationToken(earlyReturn, projectId, toolName) {
46
47
  try {
@@ -199,6 +200,20 @@ function resolveOutOfScope(provided, source = '') {
199
200
  ? Array.from(section.matchAll(/^[-*]\s+(.+)$/gm), (match) => match[1]?.trim() ?? '').filter(Boolean)
200
201
  : [];
201
202
  }
203
+ /** Redact absolute repo/home paths from every free-text field before it enters the store. */
204
+ function redactCreateSpecInput(params, root) {
205
+ const options = { root };
206
+ return {
207
+ ...params,
208
+ title: redactPortablePaths(params.title, options),
209
+ description: redactPortablePaths(params.description, options),
210
+ outOfScope: params.outOfScope?.map((item) => redactPortablePaths(item, options)),
211
+ agentTeamFindings: params.agentTeamFindings?.map((entry) => ({
212
+ ...entry,
213
+ findings: redactPortablePaths(entry.findings, options),
214
+ })),
215
+ };
216
+ }
202
217
  /** SPEC-783: Synthesize agent team findings into unified spec.md ## Technical section. */
203
218
  async function handleAgentTeamSynthesis(specId, projectPath, findings) {
204
219
  try {
@@ -976,7 +991,7 @@ export async function resolveGroundedVerificationCommands(projectPath, testPaths
976
991
  }
977
992
  }
978
993
  async function prepareCreateSpecCandidate(initialParams, server) {
979
- let params = initialParams;
994
+ let params = { ...initialParams };
980
995
  const buildResult = await measureStep('buildSpecContext', () => buildSpecContext(params));
981
996
  if (!buildResult.ok) {
982
997
  return earlyPreparation({
@@ -1238,15 +1253,12 @@ export async function handleCreateSpec(inputParams, server) {
1238
1253
  isError: true,
1239
1254
  };
1240
1255
  }
1241
- const resolvedInputParams = {
1242
- ...inputParams,
1243
- projectPath: resolvedPath,
1244
- };
1256
+ const resolvedInputParams = redactCreateSpecInput({ ...inputParams, projectPath: resolvedPath }, resolvedPath);
1245
1257
  // SPEC-697: Agent team findings synthesis path — early return before full spec creation
1246
- if (inputParams.agentTeamFindings &&
1247
- inputParams.agentTeamFindings.length > 0 &&
1248
- inputParams.specId) {
1249
- return handleAgentTeamSynthesis(inputParams.specId, resolvedPath, inputParams.agentTeamFindings);
1258
+ if (resolvedInputParams.agentTeamFindings &&
1259
+ resolvedInputParams.agentTeamFindings.length > 0 &&
1260
+ resolvedInputParams.specId) {
1261
+ return handleAgentTeamSynthesis(resolvedInputParams.specId, resolvedPath, resolvedInputParams.agentTeamFindings);
1250
1262
  }
1251
1263
  // SPEC-584: Gate check — block if pending clarification token exists and no answers provided.
1252
1264
  // Runs before the English-only gate so a second call with no translation answer hits the
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@planu/cli",
3
- "version": "5.3.19",
3
+ "version": "5.3.21",
4
4
  "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
@@ -13,6 +13,7 @@
13
13
  "!dist/**/*.map",
14
14
  "!dist/engine/*.node",
15
15
  "scripts/lib/pending-release-file.mjs",
16
+ "scripts/lib/portable-paths.mjs",
16
17
  "src/i18n/messages/",
17
18
  "planu-native.json",
18
19
  "planu-plugin.json",
@@ -35,14 +36,14 @@
35
36
  "packageName": "@planu/core"
36
37
  },
37
38
  "optionalDependencies": {
38
- "@planu/core-darwin-arm64": "5.3.19",
39
- "@planu/core-darwin-x64": "5.3.19",
40
- "@planu/core-linux-arm64-gnu": "5.3.19",
41
- "@planu/core-linux-arm64-musl": "5.3.19",
42
- "@planu/core-linux-x64-gnu": "5.3.19",
43
- "@planu/core-linux-x64-musl": "5.3.19",
44
- "@planu/core-win32-arm64-msvc": "5.3.19",
45
- "@planu/core-win32-x64-msvc": "5.3.19"
39
+ "@planu/core-darwin-arm64": "5.3.21",
40
+ "@planu/core-darwin-x64": "5.3.21",
41
+ "@planu/core-linux-arm64-gnu": "5.3.21",
42
+ "@planu/core-linux-arm64-musl": "5.3.21",
43
+ "@planu/core-linux-x64-gnu": "5.3.21",
44
+ "@planu/core-linux-x64-musl": "5.3.21",
45
+ "@planu/core-win32-arm64-msvc": "5.3.21",
46
+ "@planu/core-win32-x64-msvc": "5.3.21"
46
47
  },
47
48
  "engines": {
48
49
  "node": ">=24.0.0"
@@ -89,6 +90,7 @@
89
90
  "check": "pnpm typecheck && pnpm lint && pnpm format:check && pnpm check:destructive-ops && pnpm check:release-authorities && pnpm check:commercial-surfaces && pnpm check:tool-registration && pnpm check:public-privacy && pnpm check:website-proof && pnpm check:donation-assets && pnpm check:website-public-assets",
90
91
  "check:destructive-ops": "bash scripts/check-no-automatic-destructive-ops.sh",
91
92
  "check:strict": "pnpm check && pnpm generate:host-tool-registry -- --check && pnpm check:native-version-parity && pnpm check:environment-schema && pnpm audit:hardcodes && pnpm audit:deadcode && pnpm audit:circular && pnpm audit:types && pnpm audit:security && pnpm audit:i18n",
93
+ "check:preflight": "pnpm typecheck && pnpm lint && pnpm format:check && node scripts/check-public-privacy.mjs && node scripts/check-preflight.mjs",
92
94
  "check:reliability": "node scripts/check-reliability-policies.mjs",
93
95
  "check:environment-schema": "node scripts/check-environment-schema.mjs",
94
96
  "test:contracts": "vitest run tests/contracts tests/integration/package-consumer-hono.test.ts",
package/planu-native.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "dev.planu.native",
3
3
  "displayName": "Planu Native Lightweight Surface",
4
- "version": "5.3.19",
4
+ "version": "5.3.21",
5
5
  "packageName": "@planu/cli",
6
6
  "modes": {
7
7
  "lightweight": {
package/planu-plugin.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "name": "dev.planu.cli",
3
3
  "displayName": "Planu — Spec Driven Development",
4
4
  "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
5
- "version": "5.3.19",
5
+ "version": "5.3.21",
6
6
  "icon": "assets/plugin/icon.svg",
7
7
  "command": ["npx", "@planu/cli@latest"],
8
8
  "packageName": "@planu/cli",
@@ -0,0 +1,54 @@
1
+ import { homedir } from 'node:os';
2
+ import { join } from 'node:path';
3
+
4
+ function escapeRegExp(value) {
5
+ return value.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
6
+ }
7
+
8
+ function pathExpression(path) {
9
+ return escapeRegExp(path).replaceAll('/', '[\\\\/]');
10
+ }
11
+
12
+ function pathSegmentCount(path) {
13
+ return path.split(/[\\/]/u).filter(Boolean).length;
14
+ }
15
+
16
+ function planuDataDirectory(home, env, platform) {
17
+ if (platform === 'win32') {
18
+ const local = env.LOCALAPPDATA?.trim() || join(home, 'AppData', 'Local');
19
+ return join(local, 'Planu', 'data');
20
+ }
21
+ if (platform === 'darwin') {
22
+ return join(home, 'Library', 'Application Support', 'Planu', 'data');
23
+ }
24
+ const dataHome = env.XDG_DATA_HOME?.trim() || join(home, '.local', 'share');
25
+ return join(dataHome, 'planu');
26
+ }
27
+
28
+ export function portablePathPatterns({
29
+ root,
30
+ homeDirectory = homedir(),
31
+ env = process.env,
32
+ platform = process.platform,
33
+ } = {}) {
34
+ const home = homeDirectory.replace(/[\\/]$/u, '');
35
+ const candidates = [
36
+ { path: planuDataDirectory(home, env, platform), replacement: '<planu-data-dir>' },
37
+ { path: root, replacement: '<repo-root>' },
38
+ { path: home, replacement: '<home>' },
39
+ ].filter(
40
+ (candidate) => typeof candidate.path === 'string' && pathSegmentCount(candidate.path) >= 2,
41
+ );
42
+ candidates.sort((left, right) => right.path.length - left.path.length);
43
+ return candidates.map(({ path, replacement }) => ({
44
+ pattern: new RegExp(`(?:file:)?${pathExpression(path)}(?![A-Za-z0-9._-])`, 'giu'),
45
+ replacement,
46
+ }));
47
+ }
48
+
49
+ export function redactPortablePaths(text, options = {}) {
50
+ return portablePathPatterns(options).reduce(
51
+ (redacted, { pattern, replacement }) => redacted.replace(pattern, replacement),
52
+ text,
53
+ );
54
+ }