@gobing-ai/spur 0.3.31 → 0.3.32

package/config/workflows/task-pipeline.yaml

@@ -76,6 +76,8 @@ vars:
   # with the same package-manager surface (this monorepo is Bun-only):
   # `--vars '{"qualityGateCmd":"bun run lint && bun run test"}'`. Soft probe, hard recheck,
   # and the fixall slash input all use this same var so the command stays single-sourced.
+  # TRUSTED CONFIG ONLY — this string is executed via `sh -c` (see test/test-recheck). Never
+  # interpolate untrusted operator/LLM input into qualityGateCmd (task 0436 SECUA residual).
   qualityGateCmd: "bun run autofix && bun run spur-check"
   # Max /sp:dev-fixall attempts after a red quality-gate probe/recheck (bounded; no thrash).
   # Attempt counter: .spur/run/<wbs>-test-fix-attempt. Default 2 = two fixall hops before failed.
@@ -179,7 +181,9 @@ states:
             ATTEMPT_FILE=".spur/run/$wbs-test-fix-attempt" &&
             echo 0 > "$ATTEMPT_FILE" &&
             set +e &&
-            ( $qualityGateCmd ); gate_rc=$?; set -e &&
+            # sh -c re-parses multi-command gates (&&, ;); do NOT use bare `$qualityGateCmd`
+            # word-split (breaks on &&). qualityGateCmd is pipeline-owned trusted config only.
+            ( sh -c "$qualityGateCmd" ); gate_rc=$?; set -e &&
             if [ "$gate_rc" -eq 0 ]; then
               printf 'PASS\n' > "$STATUS_FILE";
             else
@@ -219,7 +223,8 @@ states:
             mkdir -p .spur/run &&
             STATUS_FILE=".spur/run/$wbs-test-gate.status" &&
             set +e &&
-            ( $qualityGateCmd ); gate_rc=$?; set -e &&
+            # See test probe: sh -c for multi-command; qualityGateCmd is trusted config only.
+            ( sh -c "$qualityGateCmd" ); gate_rc=$?; set -e &&
             if [ "$gate_rc" -eq 0 ]; then
               printf 'PASS\n' > "$STATUS_FILE";
             else

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.31",
+    "version": "0.3.32",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/spur.js

@@ -63914,6 +63914,37 @@ class JobWorkerService {
   }
 }
 
+// ../../packages/app/src/services/pipeline-run-link.ts
+async function ensurePipelineRunLink(db2, wbs, options = {}) {
+  const dao2 = new TaskRunLinkDao(db2);
+  const links = await dao2.listByWbs(wbs, 20);
+  const existing = links.find((l) => l.kind === "pipeline");
+  if (existing) {
+    return {
+      created: false,
+      id: existing.id,
+      wbs: existing.wbs,
+      runId: existing.run_id,
+      kind: "pipeline"
+    };
+  }
+  const id = createId("trl");
+  const runId = options.runId ?? `record:${wbs}:${Date.now()}`;
+  await dao2.insert({
+    id,
+    wbs,
+    run_id: runId,
+    kind: "pipeline",
+    created_at: new Date().toISOString()
+  });
+  return { created: true, id, wbs, runId, kind: "pipeline" };
+}
+var TASK_FORWARD_CHAIN;
+var init_pipeline_run_link = __esm(() => {
+  init_src2();
+  TASK_FORWARD_CHAIN = ["backlog", "todo", "wip", "testing", "done"];
+});
+
 // ../../packages/app/src/services/planning-events.ts
 class BusPlanningEventEmitter {
   bus;
@@ -67372,11 +67403,51 @@ class TaskService {
       result.solutionBackfilled = true;
     }
     if (opts.transition !== undefined) {
-      const transitionResult = await this.writeService.transition(ref, opts.transition);
-      result.transitionedTo = transitionResult.toStatus;
+      const target = opts.transition;
+      const current = (doc2.frontmatterData?.status ?? "").toLowerCase();
+      if (current === target) {
+        result.transitionedTo = current;
+      } else if (target === "done") {
+        if (verdict.verdict !== "PASS") {
+          throw new GuardDeniedError(`Cannot transition task ${wbs} to done: verify verdict is ${verdict.verdict}, not PASS. ` + `Re-run the pipeline to a PASS verdict, or use ` + `\`spur task update ${wbs} done --force-done --reason "<why>"\` to override.`);
+        }
+        const startIdx = TASK_FORWARD_CHAIN.indexOf(current);
+        const targetIdx = TASK_FORWARD_CHAIN.indexOf(target);
+        if (startIdx !== -1 && targetIdx !== -1 && targetIdx > startIdx) {
+          let reached = current;
+          for (let i2 = startIdx + 1;i2 <= targetIdx; i2 += 1) {
+            const hop = TASK_FORWARD_CHAIN[i2];
+            if (hop === "done") {
+              await this.ensurePipelineRunLink(wbs);
+            }
+            try {
+              const hopResult = await this.writeService.transition(ref, hop);
+              reached = hopResult.toStatus ?? hop;
+              result.transitionedTo = reached;
+            } catch (err) {
+              const msg = err instanceof Error ? err.message : String(err);
+              throw new GuardDeniedError(`Record auto-walk for task ${wbs} stopped at '${reached}' ` + `(failed hop \u2192 '${hop}'): ${msg}. ` + `Re-run \`spur task record ${wbs} --transition done\` once the guard is green.`);
+            }
+          }
+        } else {
+          await this.ensurePipelineRunLink(wbs);
+          const transitionResult = await this.writeService.transition(ref, target);
+          result.transitionedTo = transitionResult.toStatus;
+        }
+      } else {
+        const transitionResult = await this.writeService.transition(ref, target);
+        result.transitionedTo = transitionResult.toStatus;
+      }
     }
     return result;
   }
+  async ensurePipelineRunLink(wbs) {
+    const getDb = this.ctx.getDb;
+    if (getDb === undefined)
+      return;
+    const db2 = await getDb();
+    await ensurePipelineRunLink(db2, wbs);
+  }
   async batchCreate(jsonPath) {
     const raw = await this.ctx.fs.readFile(jsonPath);
     let parsed;
@@ -67714,6 +67785,8 @@ ${block}` : block);
 var DependencyMutationError, SectionMutationError, DuplicateFollowUpError, WbsCollisionError, ROSTER_START = "<!-- AUTO-GENERATED by spur task refresh-roster -->", ROSTER_END = "<!-- END AUTO-GENERATED -->", ROSTER_REGION_RE, TASK_ACTION_COMMANDS, DEFAULT_CREATION_SECTIONS;
 var init_task_service = __esm(() => {
   init_src2();
+  init_errors5();
+  init_pipeline_run_link();
   init_task_locator();
   init_task_record();
   DependencyMutationError = class DependencyMutationError extends Error {
@@ -70746,6 +70819,7 @@ __export(exports_src2, {
   extractSystemEventActor: () => extractSystemEventActor,
   extractReviewSectionBody: () => extractReviewSectionBody,
   evaluateDoneTransition: () => evaluateDoneTransition,
+  ensurePipelineRunLink: () => ensurePipelineRunLink,
   encodeRunListCursor: () => encodeRunListCursor,
   deriveVerdict: () => deriveVerdict,
   decodeRunListCursor: () => decodeRunListCursor,
@@ -70774,6 +70848,7 @@ __export(exports_src2, {
   TOKEN_LEDGER_MAX_LIMIT: () => TOKEN_LEDGER_MAX_LIMIT,
   TOKEN_LEDGER_DEFAULT_LIMIT: () => TOKEN_LEDGER_DEFAULT_LIMIT,
   TASK_LIFECYCLE_PROFILE: () => TASK_LIFECYCLE_PROFILE,
+  TASK_FORWARD_CHAIN: () => TASK_FORWARD_CHAIN,
   TASK_ACTION_COMMANDS: () => TASK_ACTION_COMMANDS,
   SystemEventEmitter: () => SystemEventEmitter,
   SupervisorService: () => SupervisorService,
@@ -70842,6 +70917,7 @@ var init_src3 = __esm(() => {
   init_feature_service();
   init_finding_codes2();
   init_history_service();
+  init_pipeline_run_link();
   init_planning_events();
   init_planning_write_service();
   init_process_inspector();
@@ -78955,7 +79031,7 @@ import { join as join19, resolve as resolve6 } from "path";
 var CLI_CONFIG = {
   binaryName: "spur",
   binaryLabel: "spur",
-  binaryVersion: "0.3.31",
+  binaryVersion: "0.3.32",
   configDir: ".spur",
   configFile: ".spur/config.yaml",
   databaseFile: ".spur/spur.db"
@@ -90654,37 +90730,22 @@ ${result.wbs} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
   task.command("run-link").summary("Record a pipeline provenance link for a task (used by --next auto chains to satisfy testing\u2192done guard).").argument("<wbs>", "Task WBS number").option("--source <source>", "Link source identifier (e.g. next-auto)", "chain").option("--run-id <id>", "Explicit run_id (auto-generated when omitted)").option("--json", "Output machine-readable JSON").action(async (wbs, options) => {
     try {
       const db2 = await context4.getDb();
-      const dao2 = new TaskRunLinkDao(db2);
-      const existing = await dao2.listByWbs(wbs, 20);
-      if (existing.some((row) => row.kind === "pipeline")) {
-        const entry = existing.find((row) => row.kind === "pipeline");
-        if (!entry) {
-          context4.output.error(`Pipeline link lookup inconsistent for ${wbs}`);
-          context4.setExitCode(1);
-          return;
-        }
-        const result2 = {
-          id: entry.id,
-          wbs: entry.wbs,
-          runId: entry.run_id,
-          kind: entry.kind,
-          existed: true
-        };
-        if (options.json) {
-          context4.output.write(toJson2(result2));
-        } else {
-          context4.output.write(`Pipeline run-link already exists for ${wbs} (${entry.id}). Skipped.`);
-        }
-        return;
-      }
-      const id = createId("trl");
-      const runId = options.runId ?? `chain:${options.source}:${wbs}:${Date.now()}`;
-      await dao2.insert({ id, wbs, run_id: runId, kind: "pipeline", created_at: new Date().toISOString() });
-      const result = { id, wbs, runId, kind: "pipeline" };
+      const ensured = await ensurePipelineRunLink(db2, wbs, {
+        runId: options.runId ?? `chain:${options.source}:${wbs}:${Date.now()}`
+      });
+      const result = {
+        id: ensured.id,
+        wbs: ensured.wbs,
+        runId: ensured.runId,
+        kind: ensured.kind,
+        existed: !ensured.created
+      };
       if (options.json) {
         context4.output.write(toJson2(result));
+      } else if (ensured.created) {
+        context4.output.write(`Recorded pipeline run-link ${ensured.id} for task ${wbs} (source: ${options.source})`);
       } else {
-        context4.output.write(`Recorded pipeline run-link ${id} for task ${wbs} (source: ${options.source})`);
+        context4.output.write(`Pipeline run-link already exists for ${wbs} (${ensured.id}). Skipped.`);
       }
     } catch (err) {
       context4.output.error(String(err));
@@ -90731,6 +90792,7 @@ async function makeService2(context4, folderOverride, noLifecycle = false) {
     fs: context4.fs,
     tasksDir,
     writeService,
+    getDb: () => context4.getDb(),
     sectionMatrix: await loadSectionMatrix(context4.cwd),
     resolveTemplate: (variant) => loadTemplateContent(context4.cwd, variant),
     resolveTemplateBodies: (variant) => loadTemplateBodies(context4.cwd, variant),