@planu/cli 5.3.68 → 5.4.0

package/CHANGELOG.md

@@ -1,3 +1,81 @@
+## [5.4.0] - 2026-08-29
+
+### Features
+- feat(SPEC-1672): install phase skills with managed-by ownership marker on init hosts
+
+### Chores
+- chore(deps): upgrade stryker to v10 majors
+- chore(deps): update 13 patch/minor dependencies and adapt readFile mock casts
+
+
+## [5.3.69] - 2026-08-29
+
+### Features
+- feat(SPEC-1674): tail or skip oversized operational graph sources instead of throwing
+
+### Bug Fixes
+- fix(SPEC-1674): include warnings in graph coverage test fixtures
+- fix(SPEC-1669): fail closed on ambiguous spec discovery, real validator in tests
+- fix(SPEC-1669): quarantine journals via atomic rename, test via init_project
+- fix(SPEC-1669): re-discover canonical spec.md when the readiness index is stale
+- fix(SPEC-1669): quarantine stale terminal migration journals instead of throwing
+- fix(SPEC-1673): capture nested vitest child output instead of inheriting stdio
+- fix(SPEC-1673): serialize load-sensitive test suites into a dedicated vitest project
+- fix(SPEC-1670): accept Next.js route group and dynamic segment characters in ownership paths
+- fix(SPEC-1674): harden oversized-source handling per implementation review
+- fix(SPEC-1674): surface persisted oversized graph sources as validate warnings
+- fix(SPEC-1674): thread oversizedSources through the build result, artifact, and query slice
+- fix(SPEC-1664): include backtick in criterion identity punctuation normalization
+- fix(SPEC-1661): guarantee cascade-hook wiring in lean release process
+- fix(SPEC-1660): grandfather full-allowlist and dynamic-import violations
+- fix(SPEC-1660): full allowlist, subpath fix, dynamic imports, exemption scope
+- fix(SPEC-1660): grandfather existing layer-boundary violations
+- fix(SPEC-1660): enforce merged layer and status-write import rules per scope
+- fix(SPEC-1320): serialize legacy session writers behind the paired refresher
+- fix(SPEC-1320): derive both session artifacts from one serialized active-spec snapshot
+
+### Refactoring
+- refactor(SPEC-1663): relocate DurableJobRecord/SpecGraph/validation-evidence types into src/types
+- refactor(SPEC-1663): rename divergent tools-cluster types off shared names
+- refactor(SPEC-1663): figma cluster imports canonical types, renames divergent thumbnail/visual-qa shapes
+- refactor(SPEC-1663): rename divergent ToolHandler/SkipReason/RollbackStep off shared names
+- refactor(SPEC-1663): rename divergent compliance catalog types off shared names
+- refactor(SPEC-1663): index.d.ts trio re-exports FileHash/FileMetadata/SpecAnnotation from types/
+- refactor(SPEC-1662): readFileOrNull — migrate 4 sites found by strengthened meta test
+- refactor(SPEC-1662): apply review fixes — enoent code check, meta-test coverage, comment cleanup
+- refactor(SPEC-1662): readFileSafe family — consolidate into src/core/shared
+- refactor(SPEC-1662): escapeRegex family — consolidate into src/core/shared
+- refactor(SPEC-1662): escapeHtml — consolidate into src/core/shared
+- refactor(SPEC-1662): fileExists/pathExists — consolidate into src/core/shared
+- refactor(SPEC-1662): setup — create src/core/shared and allow engine/storage/tools to import it
+- refactor(SPEC-1661): invert hook dispatch via injected handler; add layer-inversion tests
+- refactor(SPEC-1661): invert dashboard status update via injected handler
+- refactor(SPEC-1661): consolidate generateSpecId and spec-id schema in engine
+- refactor(SPEC-1661): remove now-unused src/types/storage-bundle.ts
+- refactor(SPEC-1661): break types->storage inversion in StorageBundle
+- refactor(SPEC-1661): move InstallationRecord/InstallationManifest into types
+
+### Chores
+- chore: scope mutation gate to mutated-range suites via dedicated vitest config
+- chore(SPEC-1669/1670): record approval and implementing transitions
+- chore(SPEC-1674): record done transition and release pending entry
+- chore(SPEC-1674): transition to implementing
+- chore(SPEC-1663): record done transition and session context
+- chore(SPEC-1663): record implementing transition
+- chore(SPEC-1662): record done transition and session artifacts
+- chore(SPEC-1662): record implementing transition
+- chore(SPEC-1664): record done transition and session artifacts
+- chore(SPEC-1664): record implementing transition
+- chore(SPEC-1661): record done transition and session artifacts
+- chore(SPEC-1661): record implementing transition
+- chore(SPEC-1660): record done transition and session artifacts
+- chore(SPEC-1660): record implementing transition
+- chore(SPEC-1660): reconcile ownership format and risk section for handoff gate
+- chore: absorb post-done session state
+- chore(SPEC-1320): record done transition
+- chore(SPEC-1320): record implementing transition and fix stale verification command
+
+
 ## [5.3.68] - 2026-08-28
 
 ### Features

package/dist/.planu-build.json

@@ -1 +1 @@
-{"schemaVersion":1,"commit":"39afacbb6522be60172b8571f6c5973000936a4a"}
+{"schemaVersion":1,"commit":"1224d53c6195e75033a881982ac489bc4f2619f3"}

package/dist/cli/commands/install.d.ts

@@ -1,4 +1,5 @@
 import type { CliCommand } from '../../types/cli.js';
+import type { InstallationManifest, InstallationRecord } from '../../types/installation.js';
 interface McpEntry {
     command: string;
     args: string[];
@@ -26,21 +27,7 @@ interface ToolDefinition {
     projectScopePath: string | null;
     format: 'standard' | 'zed';
 }
-export interface InstallationRecord {
-    host: string;
-    configPath: string;
-    format: ToolDefinition['format'];
-    scope: 'user' | 'project';
-    package: string;
-    version: string;
-    offline: boolean;
-    installedAt: string;
-}
-export interface InstallationManifest {
-    schemaVersion: 1;
-    updatedAt: string;
-    installations: InstallationRecord[];
-}
+export type { InstallationRecord, InstallationManifest } from '../../types/installation.js';
 declare function buildMcpEntry(): McpEntry;
 declare function readJsonFile(filePath: string): ToolConfig;
 declare function hasPlanuEntry(config: ToolConfig, format: ToolDefinition['format']): boolean;

package/dist/config/skill-templates/planu-dogfood-bug.md

@@ -0,0 +1,43 @@
+---
+name: planu-dogfood-bug
+description: File a bug spec the moment a Planu tool is observed behaving wrong, silent, or stale while using Planu — never deferred to a backlog or a code TODO.
+triggers:
+  - planu bug
+  - this tool is wrong
+  - unexpected planu output
+  - planu returned stale data
+  - dogfood bug
+version: 1.0.0
+managed-by: planu
+---
+
+# /planu-dogfood-bug — File a Dogfood Bug Immediately
+
+## When to invoke
+
+Use this skill the moment a Planu MCP tool returns wrong, stale, silent, or irrelevant output while it is being used for its own SDD lifecycle. Invoke it in the same turn the bug is observed — never later.
+
+**Trigger phrases**: "this tool is wrong", "unexpected Planu output", "Planu returned stale data", "dogfood bug"
+
+## How it works
+
+The normative tool-call sequence for this phase:
+
+1. **Create the spec now** — call `create_spec` in the same turn the bug is observed, with:
+   - **Reproducer** — exact tool call, exact response observed, exact expected response
+   - **Root cause hypothesis** — pointer to file path and line number in `src/` where the bug likely lives
+   - BDD acceptance criteria carrying `FILES:`, `FUNCTIONS:`, and `TEST:` markers per scenario
+   - Files to create/modify with exact paths
+   - Implementation order scoped for a cheap implementer
+2. **Move to review** — call `update_status(review)` so the bug enters the normal spec lifecycle, then continue the original task
+
+## Anti-patterns
+
+- **Never defer to a backlog** — "I'll note this for later" is not acceptable; file the spec in the same turn
+- **Never leave a code TODO** — code TODOs rot; the tracked spec is the only durable record of the bug
+- Treating a bug as "too small for a spec" — every dogfood bug becomes a spec, regardless of size
+- Filing multiple observed bugs sequentially instead of in parallel `create_spec` calls in one message
+
+## Ownership
+
+This skill is managed by Planu (`managed-by: planu` in its frontmatter). Removing that marker forks the skill from Planu's updates — future `init_project` runs will treat it as user-owned and stop refreshing it.

package/dist/config/skill-templates/planu-implement.md

@@ -0,0 +1,42 @@
+---
+name: planu-implement
+description: Implement an approved Planu spec — packages the handoff contract, moves the spec to implementing, and works in an isolated worktree with revert-proof tests and no narrative comments.
+triggers:
+  - implement the spec
+  - start implementing
+  - build this spec
+  - begin implementation
+  - implement this feature
+version: 1.0.0
+managed-by: planu
+---
+
+# /planu-implement — Implement an Approved Spec
+
+## When to invoke
+
+Use this skill once a spec is `approved` and implementation is about to begin.
+
+**Trigger phrases**: "implement the spec", "start implementing", "build this spec", "begin implementation"
+
+## How it works
+
+The normative tool-call sequence for this phase:
+
+1. **Package the handoff** — call `package_handoff` to build the operating contract for the implementer: objective, BDD acceptance criteria, files to modify/create, ownership, test plan, risks, out-of-scope, current state, next action. Persist it outside chat history
+2. **Move to implementing** — call `update_status(implementing)` only after the handoff package exists
+3. **Isolate the work** — implement inside an isolated git worktree created from the current base branch, never on the shared checkout
+4. **Write revert-proof tests** — for every guard or fix, write the test first, revert the source change and watch the test fail, then restore the source and confirm it passes. Report the observed failure output, not just the final green run
+5. **No narrative comments** — code is self-documenting; no step-by-step comments, no `(SPEC-NNNN: ...)` rationale blocks, no TODO/FIXME markers
+6. **Validate** — call `validate` when implementation is complete and inspect the completed job's `structuredContent`, not the initial acknowledgement
+
+## Anti-patterns
+
+- Implementing directly on the shared checkout instead of an isolated worktree
+- Reporting a new test as passing evidence without ever having watched it fail against the unfixed source
+- Leaving narrative comments, TODO markers, or deferred-work notes in the code
+- Treating the initial `validate` acknowledgement as a pass — only a `completed` job's result is authoritative
+
+## Ownership
+
+This skill is managed by Planu (`managed-by: planu` in its frontmatter). Removing that marker forks the skill from Planu's updates — future `init_project` runs will treat it as user-owned and stop refreshing it.

package/dist/config/skill-templates/planu-review.md

@@ -0,0 +1,47 @@
+---
+name: planu-review
+description: Review a Planu spec before approval — runs challenge_spec and check_readiness, requires independent planu-spec-reviewer evidence, then approves or requests changes.
+triggers:
+  - review the spec
+  - approve the spec
+  - is this spec ready
+  - challenge this spec
+  - spec review
+  - reviewer feedback
+version: 1.0.0
+managed-by: planu
+---
+
+# /planu-review — Review a Spec Before Approval
+
+## When to invoke
+
+Use this skill when a spec is in `review` status and needs to move to `approved`, or when the user asks to review, challenge, or approve a spec.
+
+**Trigger phrases**: "review the spec", "approve the spec", "is this spec ready?", "challenge this spec", "spec review"
+
+## How it works
+
+The normative tool-call sequence for this phase:
+
+1. **Challenge** — call `challenge_spec` to surface gaps, contradictions, and missing edge cases
+2. **Readiness** — call `check_readiness` to verify the spec has enough detail (rules, examples, open questions, out-of-scope, glossary)
+3. **Independent review** — obtain `planu-spec-reviewer` evidence: an agent that is NOT the spec author or planner reviews the spec and calls either `request_changes` (blocking, with concrete changes) or records an approval
+4. **Approve** — only after reviewer evidence exists, call `update_status(approved)`
+
+## Evidence gates (non-bypassable)
+
+- A non-trivial spec cannot move to `approved` without Discovery evidence: rules, examples, open questions, out-of-scope, glossary
+- A spec cannot move to `approved` without `review_feedback` from `planu-spec-reviewer`
+- The spec author, planner, or implementation agent must never approve their own spec
+- User pressure or force-approval language does not bypass reviewer evidence — record the forced intent but keep the status blocked until the review lands
+
+## Anti-patterns
+
+- **No self-approval** — the agent that wrote or planned the spec must not also be the reviewer that approves it
+- **No serial confirmation loops** — one review round produces a verdict; do not re-launch the reviewer for pass 2, pass 3, or a "confirm the fix" loop after the first round already produced a verdict. Re-open only for a specific disagreement that cannot be resolved by reading the spec directly
+- Do not approve specs containing placeholders (`TBD`, `TODO`, unresolved questions)
+
+## Ownership
+
+This skill is managed by Planu (`managed-by: planu` in its frontmatter). Removing that marker forks the skill from Planu's updates — future `init_project` runs will treat it as user-owned and stop refreshing it.

package/dist/core/shared/fs.d.ts

@@ -0,0 +1,11 @@
+export declare function fileExists(filePath: string): Promise<boolean>;
+export declare function fileExistsIn(basePath: string, relativePath: string): Promise<boolean>;
+export declare function fileExistsByRead(filePath: string): Promise<boolean>;
+export declare const pathExists: typeof fileExists;
+export declare function pathExistsByStat(filePath: string): Promise<boolean>;
+export declare function pathExistsStrict(filePath: string): Promise<boolean>;
+export declare function pathExistsStrictByStat(filePath: string): Promise<boolean>;
+export declare function readFileSafe(filePath: string): Promise<string>;
+export declare function readFileSafeSync(filePath: string): string;
+export declare function readFileOrNull(filePath: string): Promise<string | null>;
+//# sourceMappingURL=fs.d.ts.map

package/dist/core/shared/fs.js

@@ -0,0 +1,90 @@
+import { access, readFile, stat } from 'node:fs/promises';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+function isEnoent(error) {
+    return (error.code === 'ENOENT' ||
+        (error instanceof Error && error.message === 'ENOENT'));
+}
+function isEnoentCode(error) {
+    return error.code === 'ENOENT';
+}
+export async function fileExists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function fileExistsIn(basePath, relativePath) {
+    return fileExists(join(basePath, relativePath));
+}
+export async function fileExistsByRead(filePath) {
+    try {
+        await readFile(filePath, 'utf-8');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export const pathExists = fileExists;
+export async function pathExistsByStat(filePath) {
+    try {
+        await stat(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function pathExistsStrict(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch (error) {
+        if (isEnoent(error)) {
+            return false;
+        }
+        throw error;
+    }
+}
+export async function pathExistsStrictByStat(filePath) {
+    try {
+        await stat(filePath);
+        return true;
+    }
+    catch (error) {
+        if (isEnoentCode(error)) {
+            return false;
+        }
+        throw error;
+    }
+}
+export async function readFileSafe(filePath) {
+    try {
+        return await readFile(filePath, 'utf-8');
+    }
+    catch {
+        return '';
+    }
+}
+export function readFileSafeSync(filePath) {
+    try {
+        return readFileSync(filePath, 'utf-8');
+    }
+    catch {
+        return '';
+    }
+}
+export async function readFileOrNull(filePath) {
+    try {
+        return await readFile(filePath, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=fs.js.map

package/dist/core/shared/strings.d.ts

@@ -0,0 +1,3 @@
+export declare function escapeRegex(str: string): string;
+export declare function escapeHtml(str: string): string;
+//# sourceMappingURL=strings.d.ts.map

package/dist/core/shared/strings.js

@@ -0,0 +1,13 @@
+const REGEX_METACHARACTERS = /[.*+?^${}()|[\]\\]/g;
+export function escapeRegex(str) {
+    return str.replace(REGEX_METACHARACTERS, '\\$&');
+}
+export function escapeHtml(str) {
+    return str
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+//# sourceMappingURL=strings.js.map

package/dist/engine/actuals/git-analyzer.js

@@ -1,7 +1,7 @@
 // Planu — engine/actuals/git-analyzer.ts (SPEC-061)
 // Derives actuals from git log history for a given spec.
 import { execFileSync } from 'node:child_process';
-import { isCanonicalSpecId } from '../../tools/schemas/spec-id.js';
+import { isCanonicalSpecId } from '../spec-format/spec-id.js';
 const MAX_SESSION_GAP_MS = 2 * 60 * 60 * 1000; // 2 hours
 const REVIEW_HOURS_RATIO = 0.15;
 const MINIMUM_DEV_HOURS = 1;

package/dist/engine/actuals/progress-parser.js

@@ -1,6 +1,4 @@
-function escapeRegex(input) {
-    return input.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
+import { escapeRegex } from '../../core/shared/strings.js';
 /**
  * Parses progress.md content and extracts any actual metrics found.
  *

package/dist/engine/agent-handoff-store.js

@@ -1,6 +1,7 @@
 // engine/agent-handoff-store.ts — SPEC-639: handoff.json protocol for agent teams
 import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import { join } from 'node:path';
+// eslint-disable-next-line no-restricted-imports -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
 import { hashProjectPath, projectDataDir } from '../storage/base-store.js';
 function handoffPath(projectPath, specId) {
     return join(projectDataDir(hashProjectPath(projectPath)), 'team', specId, 'handoff.json');

package/dist/engine/agent-squad/dispatcher.js

@@ -3,6 +3,7 @@ import { readFile } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { resolveAgents } from '../agent-router.js';
+// eslint-disable-next-line no-restricted-imports -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
 import { appendSquadRun, getSquadConfig } from '../../storage/agent-squad-store.js';
 const CONFIG_DIR = join(dirname(fileURLToPath(import.meta.url)), '../../config');
 async function loadRegistry() {

package/dist/engine/agent-telemetry.js

@@ -3,6 +3,7 @@ import { appendFile, stat, readFile, writeFile, mkdir } from 'node:fs/promises';
 import { createReadStream } from 'node:fs';
 import { createInterface } from 'node:readline';
 import { join } from 'node:path';
+// eslint-disable-next-line no-restricted-imports -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
 import { hashProjectPath, projectDataDir } from '../storage/base-store.js';
 const MAX_FILE_BYTES = 1024 * 1024; // 1 MB
 const PRUNE_AGE_MS = 30 * 24 * 60 * 60 * 1000; // 30 days

package/dist/engine/auth/config.js

@@ -3,6 +3,7 @@
 // Persists to the canonical config root. Never persists tokens.
 import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import { join } from 'node:path';
+// eslint-disable-next-line no-restricted-imports -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
 import { resolveStorageLayout } from '../../storage/storage-layout.js';
 const CONFIG_DIR = resolveStorageLayout().config;
 const CONFIG_PATH = join(CONFIG_DIR, 'auth-config.json');

package/dist/engine/auto-updater/atomic-upgrade.js

@@ -1,6 +1,7 @@
 import { readFile, rm } from 'node:fs/promises';
 import { isAbsolute } from 'node:path';
 import { atomicWriteFile } from '../safety/atomic-write-file.js';
+// eslint-disable-next-line no-restricted-imports -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
 import { readInstallationManifest, } from '../../cli/commands/install.js';
 import { buildPinnedEntry } from './config-patcher.js';
 import { stageAndVerifyRelease } from './release-verifier.js';

package/dist/engine/auto-updater/index.js

@@ -5,6 +5,7 @@ import { detectPlanuInstall } from './config-detector.js';
 import { buildPinnedEntry } from './config-patcher.js';
 import { fetchLatestVersion } from './npm-registry.js';
 import { PLANU_VERSION } from '../../config/version.js';
+// eslint-disable-next-line no-restricted-imports -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
 import { resolveStorageLayout } from '../../storage/storage-layout.js';
 import { upgradeInventoriedAdapters } from './atomic-upgrade.js';
 export { upgradeInventoriedAdapters } from './atomic-upgrade.js';

package/dist/engine/autopilot/action-registry.js

@@ -79,6 +79,7 @@ const ACTION_HANDLERS = {
         if (!ctx.specId) {
             return { success: false, summary: 'No specId', durationMs: 0 };
         }
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { handleSuggestCriteria } = await import('../../tools/domain-criteria-handler.js');
         const result = await handleSuggestCriteria({
             projectId: ctx.projectId,
@@ -91,6 +92,7 @@ const ACTION_HANDLERS = {
         };
     }),
     detect_contradictions: wrapHandler('detect_contradictions', async (ctx) => {
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { specStore } = await import('../../storage/index.js');
         const { detectContradictions } = await import('../contradiction-detector.js');
         const specs = await specStore.listSpecs(ctx.projectId);
@@ -116,6 +118,7 @@ const ACTION_HANDLERS = {
         if (!ctx.specId) {
             return { success: false, summary: 'No specId', durationMs: 0 };
         }
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { handleChallengeSpec } = await import('../../tools/challenge-spec.js');
         const result = await handleChallengeSpec({
             projectPath: ctx.projectPath,
@@ -131,6 +134,7 @@ const ACTION_HANDLERS = {
         if (!ctx.specId) {
             return { success: false, summary: 'No specId', durationMs: 0 };
         }
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { handleSpecQualityScore } = await import('../../tools/spec-quality-score-handler.js');
         const result = await handleSpecQualityScore({
             projectPath: ctx.projectPath,
@@ -146,6 +150,7 @@ const ACTION_HANDLERS = {
         if (!ctx.specId) {
             return { success: false, summary: 'No specId', durationMs: 0 };
         }
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { handleOrchestrateAgents } = await import('../../tools/orchestrate-agents-handler.js');
         const result = await handleOrchestrateAgents({
             projectPath: ctx.projectPath,
@@ -163,11 +168,13 @@ const ACTION_HANDLERS = {
             return { success: false, summary: 'No specId', durationMs: 0 };
         }
         // TDD scaffold needs specPath — resolve from specId
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { specStore } = await import('../../storage/index.js');
         const spec = await specStore.getSpec(ctx.projectId, ctx.specId);
         if (!spec?.specPath) {
             return { success: false, summary: `Spec ${ctx.specId} has no specPath`, durationMs: 0 };
         }
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { handleTddScaffold } = await import('../../tools/tdd-scaffold-handler.js');
         const result = await handleTddScaffold({
             projectPath: ctx.projectPath,
@@ -198,6 +205,7 @@ const ACTION_HANDLERS = {
         };
     }),
     generate_changelog: wrapHandler('generate_changelog', async (ctx) => {
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { specStore } = await import('../../storage/index.js');
         const specs = await specStore.listSpecs(ctx.projectId);
         const { generateChangelog } = await import('../doc-generator/support-generators.js');
@@ -205,6 +213,7 @@ const ACTION_HANDLERS = {
         // Generated changelog is returned to callers; strict Planu mode forbids planu/CHANGELOG.md.
         const { writeFile, mkdir } = await import('node:fs/promises');
         const { join } = await import('node:path');
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { projectDataDir } = await import('../../storage/base-store.js');
         const changelogPath = join(projectDataDir(ctx.projectId), 'generated', 'CHANGELOG.md');
         await mkdir(join(projectDataDir(ctx.projectId), 'generated'), { recursive: true });
@@ -237,6 +246,7 @@ const ACTION_HANDLERS = {
         };
     }),
     log_lesson: wrapHandler('log_lesson', async (ctx) => {
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { addLesson } = await import('../../storage/lessons-store.js');
         // drift:detected events (auto-drift.ts) are project-wide and carry no
         // ctx.specId; fall back to the payload's specIds so the lesson stays
@@ -264,6 +274,7 @@ const ACTION_HANDLERS = {
     }),
     // ── B.2: spec:created triggers ──────────────────────────────────────────────
     heal_spec_docs: wrapHandler('heal_spec_docs', async (ctx) => {
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { handleHealSpecDocs } = await import('../../tools/heal-spec-docs.js');
         // SPEC-579: pass specId so cascade-triggered healing scopes to the changing
         // spec only, instead of mass-rewriting all technical.md files in the project.
@@ -278,6 +289,7 @@ const ACTION_HANDLERS = {
         };
     }),
     similar_problems_finder: wrapHandler('similar_problems_finder', async (ctx) => {
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { handleSimilarProblemsFinder } = await import('../../tools/knowledge-base-handler.js');
         const result = await handleSimilarProblemsFinder({
             projectPath: ctx.projectPath,
@@ -294,6 +306,7 @@ const ACTION_HANDLERS = {
         if (!ctx.specId) {
             return { success: false, summary: 'No specId', durationMs: 0 };
         }
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { specStore } = await import('../../storage/index.js');
         const spec = await specStore.getSpec(ctx.projectId, ctx.specId);
         if (!spec) {
@@ -309,6 +322,7 @@ const ACTION_HANDLERS = {
         };
     }),
     run_spec_lint: wrapHandler('run_spec_lint', async (ctx) => {
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { handleRunSpecLint } = await import('../../tools/spec-lint-handler.js');
         const result = await handleRunSpecLint({
             projectPath: ctx.projectPath,
@@ -341,6 +355,7 @@ const ACTION_HANDLERS = {
         if (!ctx.specId) {
             return { success: false, summary: 'No specId', durationMs: 0 };
         }
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { handleSpecHealthCheck } = await import('../../tools/validation-loop-handler.js');
         const result = await handleSpecHealthCheck({
             projectPath: ctx.projectPath,
@@ -353,6 +368,7 @@ const ACTION_HANDLERS = {
         };
     }),
     check_parallel_safety: wrapHandler('check_parallel_safety', async (ctx) => {
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { handleCheckParallelSafety } = await import('../../tools/parallel-safety-handler.js');
         const result = handleCheckParallelSafety({ projectPath: ctx.projectPath });
         return {
@@ -366,6 +382,7 @@ const ACTION_HANDLERS = {
         if (!ctx.specId) {
             return { success: false, summary: 'No specId', durationMs: 0 };
         }
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { handleAutoFixValidation } = await import('../../tools/auto-fix-validation.js');
         const result = await handleAutoFixValidation({
             projectPath: ctx.projectPath,
@@ -380,6 +397,7 @@ const ACTION_HANDLERS = {
         };
     }),
     calibrate_estimates: wrapHandler('calibrate_estimates', async (ctx) => {
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { handleCalibrateEstimates } = await import('../../tools/estimation-accuracy-handler.js');
         const result = await handleCalibrateEstimates({
             projectPath: ctx.projectPath,
@@ -394,6 +412,7 @@ const ACTION_HANDLERS = {
         if (!ctx.specId) {
             return { success: false, summary: 'No specId', durationMs: 0 };
         }
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { specStore } = await import('../../storage/index.js');
         const spec = await specStore.getSpec(ctx.projectId, ctx.specId);
         const specPath = spec?.specPath ?? ctx.specId;
@@ -410,6 +429,7 @@ const ACTION_HANDLERS = {
         if (!ctx.specId) {
             return { success: false, summary: 'No specId', durationMs: 0 };
         }
+        // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
         const { handleGenerateEdgeTests } = await import('../../tools/tdd-handler.js');
         const result = await handleGenerateEdgeTests({
             projectPath: ctx.projectPath,

package/dist/engine/autopilot/audit-logger.js

@@ -1,6 +1,7 @@
 // engine/autopilot/audit-logger.ts — SPEC-468: Persistent audit log for autopilot cascade actions
 import { appendFile, readFile, mkdir, writeFile } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
+// eslint-disable-next-line no-restricted-imports -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
 import { hashProjectPath, projectDataDir } from '../../storage/base-store.js';
 const MAX_LINES = 1000;
 /** Fire-and-forget write. Never blocks. */

package/dist/engine/autopilot/bootstrap.js

@@ -32,6 +32,7 @@ function registerImplementingCascadeListener() {
     onAutopilotEvent('spec:status:implementing', (event) => {
         void (async () => {
             try {
+                // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
                 const { handleRecommendModel } = await import('../../tools/recommend-model-handler.js');
                 handleRecommendModel({ specId: event.specId });
             }
@@ -39,7 +40,9 @@ function registerImplementingCascadeListener() {
                 /* best-effort */
             }
             try {
-                const { handleContextWindowStatus } = await import('../../tools/context-manager-handler.js');
+                const { handleContextWindowStatus } = 
+                // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
+                await import('../../tools/context-manager-handler.js');
                 await handleContextWindowStatus({ projectPath: event.projectPath });
             }
             catch {
@@ -81,6 +84,7 @@ function registerPluginInstalledListener() {
                 if (!Array.isArray(pluginIds) || pluginIds.length === 0) {
                     return;
                 }
+                // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
                 const { handleManagePlugins } = await import('../../tools/manage-plugins-handler.js');
                 for (const pluginId of pluginIds) {
                     if (typeof pluginId !== 'string') {
@@ -108,7 +112,10 @@ function registerSemanticIndexRefreshListener() {
     onAutopilotEvent('spec:created', (event) => {
         void (async () => {
             try {
-                const { getOrCreateBackend } = await import('../../storage/vector-store/backend-factory.js');
+                const { getOrCreateBackend } = 
+                // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
+                await import('../../storage/vector-store/backend-factory.js');
+                // eslint-disable-next-line no-restricted-syntax -- grandfathered layer violation, remediation SPEC-1661 SPEC-1662 SPEC-1663
                 const { SemanticIndexStore } = await import('../../storage/semantic-index-store.js');
                 const backend = await getOrCreateBackend(event.projectId);
                 const allDocs = await backend.getAll();