@planu/cli 5.3.24 → 5.3.26

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+## [5.3.26] - 2026-08-19
+
+### Bug Fixes
+- fix(spec-1569-1572): host-LLM legacy migration, gitignore allowlist, scope+section guards
+
+### Chores
+- chore(spec-1569-1572): mark legacy-migration and guard specs done
+
+
+## [5.3.25] - 2026-08-18
+
+### Bug Fixes
+- fix(spec-1562,1568): contain client output paths across all writers and default spec array fields
+
+
 ## [5.3.24] - 2026-08-18
 
 ### Bug Fixes

package/README.md

@@ -21,7 +21,7 @@ Planu is a Spec Driven Development stack for AI coding agents: an MCP server and
 - **Local change detection** — observes project changes without requiring a hosted configuration service.
 - **Unified Spec Format** — Requirements and technical details in a single, context-efficient `spec.md`.
 - **Atomic Integrity** — Indestructible writes and **Freeze-on-done** immutability (P0).
-- **29 official MCP tools** for the public SDD surface, with advanced workflows kept in skills, CLI commands, and internal pipelines.
+- **30 official MCP tools** for the public SDD surface, with advanced workflows kept in skills, CLI commands, and internal pipelines.
 - **Multi-agent compatible** — Optimized for Claude Code, Cursor, Windsurf, and Gemini CLI.
 
 ---

package/dist/config/legacy-artifacts.json

@@ -0,0 +1,26 @@
+[
+  {
+    "id": "technical-md",
+    "pattern": "technical.md",
+    "classification": "content-bearing",
+    "targetSection": "Technical"
+  },
+  { "id": "plan-md", "pattern": "plan.md", "classification": "content-bearing", "targetSection": "Technical" },
+  { "id": "plan-md-upper", "pattern": "PLAN.md", "classification": "content-bearing", "targetSection": "Technical" },
+  {
+    "id": "ficha-tecnica-md",
+    "pattern": "FICHA-TECNICA.md",
+    "classification": "content-bearing",
+    "targetSection": "Technical"
+  },
+  { "id": "progress-md", "pattern": "progress.md", "classification": "content-bearing", "targetSection": "Progress" },
+  {
+    "id": "progress-md-upper",
+    "pattern": "PROGRESS.md",
+    "classification": "content-bearing",
+    "targetSection": "Progress"
+  },
+  { "id": "hu-md", "pattern": "HU.md", "classification": "content-bearing", "targetSection": "Problem" },
+  { "id": "child-plans-dir", "pattern": "child-plans", "classification": "transient" },
+  { "id": "behavior-evidence-json", "pattern": "behavior-evidence.json", "classification": "transient" }
+]

package/dist/config/official-sdd-tools.d.ts

@@ -1,4 +1,4 @@
 /** Single editable authority for the official local SDD tool surface. */
-export declare const OFFICIAL_SDD_TOOL_NAMES: readonly ['planu_status', 'session_checkpoint', 'facilitate', 'init_project', 'clarify_requirements', 'create_spec', 'list_specs', 'challenge_spec', 'check_readiness', 'update_status', 'update_status_batch', 'package_handoff', 'validate', 'get_job', 'watch_job', 'cancel_job', 'restart_job', 'reconcile_spec', 'create_rule', 'create_skill', 'skill_search', 'configure_code_graph', 'code_graph_status', 'submit_feedback', 'triage_feedback', 'resolve_feedback', 'sync_feedback', 'feedback_status', 'bump_spec_version'];
+export declare const OFFICIAL_SDD_TOOL_NAMES: readonly ['planu_status', 'session_checkpoint', 'facilitate', 'init_project', 'clarify_requirements', 'create_spec', 'list_specs', 'challenge_spec', 'check_readiness', 'update_status', 'update_status_batch', 'package_handoff', 'validate', 'get_job', 'watch_job', 'cancel_job', 'restart_job', 'reconcile_spec', 'create_rule', 'create_skill', 'skill_search', 'configure_code_graph', 'code_graph_status', 'submit_feedback', 'triage_feedback', 'resolve_feedback', 'sync_feedback', 'feedback_status', 'bump_spec_version', 'migrate_legacy_spec'];
 export declare function readCanonicalToolNames(): string[];
 //# sourceMappingURL=official-sdd-tools.d.ts.map

package/dist/config/official-sdd-tools.js

@@ -29,6 +29,7 @@ export const OFFICIAL_SDD_TOOL_NAMES = [
     'sync_feedback',
     'feedback_status',
     'bump_spec_version',
+    'migrate_legacy_spec',
 ];
 export function readCanonicalToolNames() {
     return [...OFFICIAL_SDD_TOOL_NAMES];

package/dist/config/registries/hosts/codex.json

@@ -31,7 +31,8 @@
     "resolve_feedback",
     "sync_feedback",
     "feedback_status",
-    "bump_spec_version"
+    "bump_spec_version",
+    "migrate_legacy_spec"
   ],
   "unsupportedTools": ["challenge_spec", "red_team"],
   "restrictedTools": {

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.24",
-  "engineVersion": "5.3.24",
-  "buildId": "1-5.3.24-aarch64-apple-darwin",
+  "cliVersion": "5.3.26",
+  "engineVersion": "5.3.26",
+  "buildId": "1-5.3.26-aarch64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "2df1b275f0d3987ef6fa75a7d46b274c798aece674ff001ab7fb7af169cfc1f3",
+  "artifactSha256": "b2d852dc52754af4bb30c62703566f1904ef5d36905a500ee93dd659d2a5e1e2",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-arm64.node.sbom.json",
-    "sha256": "9899ebee8d32c9b58992bd9a95647e85bd86ac76ee64c34f534f5ce18ec33c2c"
+    "sha256": "f40d46dc1cafb9791a5abb6b22715025ed1a46ebbece82949b770e92009a33d0"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
+    "sourceCommit": "2419aedc35345da335c3469eaf80b19f428fd53b",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "0/ir1zotrdZMQ3fKgbpHGoU6fXXo8qZp+Ugs18Oslbxb6vVvRBuj2UoKofDsyPGjx2mHadvTUPX42B/EZd1SAg=="
+    "value": "chGhyQXfG6qVz8U+TCAugdrFAW9pvbketCjVF0BESmKZlIMKyzq15V3r8QSuBOGqCs3OtuORM0R6VRJEreHlAA=="
   }
 }

package/dist/engine/planu-core.darwin-arm64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.24",
+      "bom-ref": "pkg:cargo/planu-core@5.3.26",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.24",
+      "version": "5.3.26",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2df1b275f0d3987ef6fa75a7d46b274c798aece674ff001ab7fb7af169cfc1f3"
+          "content": "b2d852dc52754af4bb30c62703566f1904ef5d36905a500ee93dd659d2a5e1e2"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.24",
+      "ref": "pkg:cargo/planu-core@5.3.26",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.darwin-x64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.24",
-  "engineVersion": "5.3.24",
-  "buildId": "1-5.3.24-x86_64-apple-darwin",
+  "cliVersion": "5.3.26",
+  "engineVersion": "5.3.26",
+  "buildId": "1-5.3.26-x86_64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "136a1351ca4278942b7c5b0130eb7cdfee35b85b667888d4041bffcd0b213ace",
+  "artifactSha256": "6a08bbe0d147a81c8f9094651912b89f2a7bbd9d4ab09e8f713db3493469ba68",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-x64.node.sbom.json",
-    "sha256": "3f8f6cace3e98634bc5fb5b8debb71c45507b890b4aa918437358cf16b55d776"
+    "sha256": "2aa4b1f6dfe3be29bfafa818692dd08f629763eb02b7f0119a0ba828c5de11d8"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
+    "sourceCommit": "2419aedc35345da335c3469eaf80b19f428fd53b",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "Aj0I1f16YmStyyCshvbh7h+leFhLBtGAOv5Jy8lCH5oXVc2RBirqfHNAU/4yQ1vFu3JTl3H5hIaa1Kc1LwQtCg=="
+    "value": "gVWSBJ6t5K9Jl6iC3VDEqApdsZXpGKK/+Qv75Ijp6JinDPZvqO8ESVeO4RonNELQljv5r0DFgvR+5Z+IfsNxAg=="
   }
 }

package/dist/engine/planu-core.darwin-x64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.24",
+      "bom-ref": "pkg:cargo/planu-core@5.3.26",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.24",
+      "version": "5.3.26",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "136a1351ca4278942b7c5b0130eb7cdfee35b85b667888d4041bffcd0b213ace"
+          "content": "6a08bbe0d147a81c8f9094651912b89f2a7bbd9d4ab09e8f713db3493469ba68"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.24",
+      "ref": "pkg:cargo/planu-core@5.3.26",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.24",
-  "engineVersion": "5.3.24",
-  "buildId": "1-5.3.24-aarch64-unknown-linux-gnu",
+  "cliVersion": "5.3.26",
+  "engineVersion": "5.3.26",
+  "buildId": "1-5.3.26-aarch64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "glibc",
-  "artifactSha256": "5c16c2a04af25efc03e74eecfacaad43f5835dfb01f0a898f6d2b93efd9a3c33",
+  "artifactSha256": "1d9dfeccdff69d18bbddbd0824dca6742c4a3ecd9e66b52cace270eddb900444",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-gnu.node.sbom.json",
-    "sha256": "48a3812ed288b4801a82bf40f37d02e48e014a90f58f7bc955c2b480749cd44e"
+    "sha256": "9b9271f9439cc9be0737167da1453b37dd2607891da718aa4dd355edf57286fe"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
+    "sourceCommit": "2419aedc35345da335c3469eaf80b19f428fd53b",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "ogNVi4bjUVYnZ3o32PbiLKjRM4FhpcRuLoWSBpHe+vMe/M+oL+aZAX3M86UdTHoxEtUm32rJJPBBXA3CpQzIBQ=="
+    "value": "bo+EsDcaAkbFJiPyt3Fdenl+cKnPfTysWT7PfJKVAxYpdyWFv9prn7G7Hb8LwVjgsUulNv/v7+Uwx+R0O9ywBw=="
   }
 }

package/dist/engine/planu-core.linux-arm64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.24",
+      "bom-ref": "pkg:cargo/planu-core@5.3.26",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.24",
+      "version": "5.3.26",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5c16c2a04af25efc03e74eecfacaad43f5835dfb01f0a898f6d2b93efd9a3c33"
+          "content": "1d9dfeccdff69d18bbddbd0824dca6742c4a3ecd9e66b52cace270eddb900444"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.24",
+      "ref": "pkg:cargo/planu-core@5.3.26",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.24",
-  "engineVersion": "5.3.24",
-  "buildId": "1-5.3.24-aarch64-unknown-linux-musl",
+  "cliVersion": "5.3.26",
+  "engineVersion": "5.3.26",
+  "buildId": "1-5.3.26-aarch64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "musl",
-  "artifactSha256": "8a4cd204fed117c35b4daea2d03d7f36c5ac2309967ed1d0f48e4291c19a705f",
+  "artifactSha256": "998d8d6076161d998a11a57c2c06f291e4f73caa638bd530c6391926456c9e88",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-musl.node.sbom.json",
-    "sha256": "812aeaa48a5c2d31b1b108a005eb47586f8a3cf48de44ee7a43b356d7626a286"
+    "sha256": "1d0bc13dc8e4c207ae2a6eb857b1be214cce702f2be06b1538078e54a2285f8d"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
+    "sourceCommit": "2419aedc35345da335c3469eaf80b19f428fd53b",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "3w2XPj4GH8F/UdRBJMNWiOacR+v5h2H/aof6SqdJDADu5S2sGg0IEolD9m7sB3HE/ZgPL7iulY4KPckXGMNnAQ=="
+    "value": "E3FUnw4F0Mo18fXF12PdntrhwZ5PpG3jrUnwRIo+xL62Ij5XDe0CiF8n9cSBALGLSUCeytaeYPWYsPjq5DO3CQ=="
   }
 }

package/dist/engine/planu-core.linux-arm64-musl.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.24",
+      "bom-ref": "pkg:cargo/planu-core@5.3.26",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.24",
+      "version": "5.3.26",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8a4cd204fed117c35b4daea2d03d7f36c5ac2309967ed1d0f48e4291c19a705f"
+          "content": "998d8d6076161d998a11a57c2c06f291e4f73caa638bd530c6391926456c9e88"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.24",
+      "ref": "pkg:cargo/planu-core@5.3.26",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.24",
-  "engineVersion": "5.3.24",
-  "buildId": "1-5.3.24-x86_64-unknown-linux-gnu",
+  "cliVersion": "5.3.26",
+  "engineVersion": "5.3.26",
+  "buildId": "1-5.3.26-x86_64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "glibc",
-  "artifactSha256": "a9158723fa6e3e5972ffc03b6115035c1f0dd6be8b109b4ae1f7f5dad54f9062",
+  "artifactSha256": "82aad07391992062c26f860f5ef9beab126048cae4c56c1c3eb097c7edad674d",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-gnu.node.sbom.json",
-    "sha256": "34a5c6540f4234a5ac3d4b3d1be2ff50e28b294161a4b4190996e28b3defc899"
+    "sha256": "2e5cd34fb3b8e6bf81f6da6c09a7a777f274ee7c6a55696d7541622383e250e1"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
+    "sourceCommit": "2419aedc35345da335c3469eaf80b19f428fd53b",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "Gz3e+x1vn4R0ppFCaBwO4vQH1RqrV3PvTp7/Zi6V0mu3u6o1GYmo7JrLvlmR4I34IWkfO+cG6Hk/Ls++j7dnBw=="
+    "value": "di+vGzqgsPMmHH/6UFcIElY003sMfb/Q/MduHuxY06aY6JT82QNuLNx1mkV3+MYhJhynyMsaBxt7Vin/FTPUBA=="
   }
 }

package/dist/engine/planu-core.linux-x64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.24",
+      "bom-ref": "pkg:cargo/planu-core@5.3.26",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.24",
+      "version": "5.3.26",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a9158723fa6e3e5972ffc03b6115035c1f0dd6be8b109b4ae1f7f5dad54f9062"
+          "content": "82aad07391992062c26f860f5ef9beab126048cae4c56c1c3eb097c7edad674d"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.24",
+      "ref": "pkg:cargo/planu-core@5.3.26",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.24",
-  "engineVersion": "5.3.24",
-  "buildId": "1-5.3.24-x86_64-unknown-linux-musl",
+  "cliVersion": "5.3.26",
+  "engineVersion": "5.3.26",
+  "buildId": "1-5.3.26-x86_64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "musl",
-  "artifactSha256": "165e48d9d7bb68965782b9f690af378cee9651c9c1b9ab31e6b9fa4bedad514a",
+  "artifactSha256": "91d71782f92e585b90444463370ec9d600b25a52a1d892b903676d4c8fddd2ad",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-musl.node.sbom.json",
-    "sha256": "101e2eca5854d33b36a9570a10e8f4816f43961ad899863110ba4d2596cf89dc"
+    "sha256": "5fa1e3aed4b54c4fef050d7a541c2bbbed4ffec3fc21667818df15572087e7a4"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
+    "sourceCommit": "2419aedc35345da335c3469eaf80b19f428fd53b",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "bHo9hflPuXFXSTyWqcxf2rV+OlBmqGvUMOgp4WV7TfKOC1nCUV7Ay/1LJXlgqN/XykbfHC8821FpHWLXQSnJDQ=="
+    "value": "N+t5MBnx7wr/JyNeJ+8887ZHguXLM9IgP8UT+p5CqZsooNBCHKXErn9vUyRWNHdR8bJ0zqVIOnWMq44Lmh/PDw=="
   }
 }

package/dist/engine/planu-core.linux-x64-musl.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.24",
+      "bom-ref": "pkg:cargo/planu-core@5.3.26",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.24",
+      "version": "5.3.26",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "165e48d9d7bb68965782b9f690af378cee9651c9c1b9ab31e6b9fa4bedad514a"
+          "content": "91d71782f92e585b90444463370ec9d600b25a52a1d892b903676d4c8fddd2ad"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.24",
+      "ref": "pkg:cargo/planu-core@5.3.26",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.win32-arm64-msvc.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.24",
-  "engineVersion": "5.3.24",
-  "buildId": "1-5.3.24-aarch64-pc-windows-msvc",
+  "cliVersion": "5.3.26",
+  "engineVersion": "5.3.26",
+  "buildId": "1-5.3.26-aarch64-pc-windows-msvc",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "win32",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "363abf41c92e4a6d5e4f7cc821185cca9a84fe5fb99006b8e01d16d106bbfa52",
+  "artifactSha256": "42242fb16dcedcff4ccdc5a8d359279ba985a916eab84e803b98d1840cc2a59e",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.win32-arm64-msvc.node.sbom.json",
-    "sha256": "5f31abd4a8f741b8a72701f428fa777b41a504c1c095f903bdf54b5ccd93b74e"
+    "sha256": "cbdd51f8b9ff70711b39912839dc7d03b1670056ab8909aa46d2b90ad5e25cbb"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
+    "sourceCommit": "2419aedc35345da335c3469eaf80b19f428fd53b",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "Dj6P860+E1Yi4MGQd3lnA6OmAmf5EvL8mZqfiI81OwYH19GQwnKnBUi5vjh64I781B1lyOwUOPjU+jLpJ8lhCQ=="
+    "value": "lYI+Oujs1RPS2A9qzkJC5Jf2ISaSxjMJkXH44GgpLJfNXsvSYTBFx6lq+gpzo2R0tiUvF7JSWG4+WfI2I5KYCg=="
   }
 }

package/dist/engine/planu-core.win32-arm64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.24",
+      "bom-ref": "pkg:cargo/planu-core@5.3.26",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.24",
+      "version": "5.3.26",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "363abf41c92e4a6d5e4f7cc821185cca9a84fe5fb99006b8e01d16d106bbfa52"
+          "content": "42242fb16dcedcff4ccdc5a8d359279ba985a916eab84e803b98d1840cc2a59e"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.24",
+      "ref": "pkg:cargo/planu-core@5.3.26",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.win32-x64-msvc.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.24",
-  "engineVersion": "5.3.24",
-  "buildId": "1-5.3.24-x86_64-pc-windows-msvc",
+  "cliVersion": "5.3.26",
+  "engineVersion": "5.3.26",
+  "buildId": "1-5.3.26-x86_64-pc-windows-msvc",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "win32",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "0b6374ac67d414e13e2e02be6be96a388ed9096f517587f812c533c5fb37992f",
+  "artifactSha256": "a83417f73e4210940eef71c672d093af314be694ac60b961be41cf126f16ab8b",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.win32-x64-msvc.node.sbom.json",
-    "sha256": "aaaafe7c267638012a520782ad059014a0641b55005e2a09a5bace53a00d3d3e"
+    "sha256": "a7eb5568757d44ba58a01b986573da423b7caa512d122e0de42fbe4f8a6d23c6"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
+    "sourceCommit": "2419aedc35345da335c3469eaf80b19f428fd53b",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "zUMqIwI3WSWZ0QbesWdiZfnIlwAnwkhfwN2Us0lmUCtoKOtQEkqckxNZCY7tuxbzhS091T5LUp7Y+HOUeUViCg=="
+    "value": "cOjoj33opvadNE+ow9eezowf1I8vVGssK+KioLL5P2HfMP6UmwG0MVJNCpGj4h6JMF+qnu4/k7WMEVHmEcSgAA=="
   }
 }

package/dist/engine/planu-core.win32-x64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.24",
+      "bom-ref": "pkg:cargo/planu-core@5.3.26",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.24",
+      "version": "5.3.26",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0b6374ac67d414e13e2e02be6be96a388ed9096f517587f812c533c5fb37992f"
+          "content": "a83417f73e4210940eef71c672d093af314be694ac60b961be41cf126f16ab8b"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.24",
+      "ref": "pkg:cargo/planu-core@5.3.26",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/safety/assert-within-project.d.ts

@@ -0,0 +1,2 @@
+export declare function assertPathWithinBase(baseDir: string, candidatePath: string): string;
+//# sourceMappingURL=assert-within-project.d.ts.map

package/dist/engine/safety/assert-within-project.js

@@ -0,0 +1,14 @@
+import { isAbsolute, relative, resolve } from 'node:path';
+export function assertPathWithinBase(baseDir, candidatePath) {
+    const resolvedBase = resolve(baseDir);
+    const resolvedCandidate = resolve(candidatePath);
+    const rel = relative(resolvedBase, resolvedCandidate);
+    if (rel === '') {
+        return resolvedCandidate;
+    }
+    if (rel.startsWith('..') || isAbsolute(rel)) {
+        throw new Error(`Path escapes the project directory: resolved candidate "${resolvedCandidate}" is not within base "${resolvedBase}".`);
+    }
+    return resolvedCandidate;
+}
+//# sourceMappingURL=assert-within-project.js.map