@gobing-ai/spur 0.3.31 → 0.3.33

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -76,6 +76,8 @@ vars:
76
76
  # with the same package-manager surface (this monorepo is Bun-only):
77
77
  # `--vars '{"qualityGateCmd":"bun run lint && bun run test"}'`. Soft probe, hard recheck,
78
78
  # and the fixall slash input all use this same var so the command stays single-sourced.
79
+ # TRUSTED CONFIG ONLY — this string is executed via `sh -c` (see test/test-recheck). Never
80
+ # interpolate untrusted operator/LLM input into qualityGateCmd (task 0436 SECUA residual).
79
81
  qualityGateCmd: "bun run autofix && bun run spur-check"
80
82
  # Max /sp:dev-fixall attempts after a red quality-gate probe/recheck (bounded; no thrash).
81
83
  # Attempt counter: .spur/run/<wbs>-test-fix-attempt. Default 2 = two fixall hops before failed.
@@ -179,7 +181,9 @@ states:
179
181
  ATTEMPT_FILE=".spur/run/$wbs-test-fix-attempt" &&
180
182
  echo 0 > "$ATTEMPT_FILE" &&
181
183
  set +e &&
182
- ( $qualityGateCmd ); gate_rc=$?; set -e &&
184
+ # sh -c re-parses multi-command gates (&&, ;); do NOT use bare `$qualityGateCmd`
185
+ # word-split (breaks on &&). qualityGateCmd is pipeline-owned trusted config only.
186
+ ( sh -c "$qualityGateCmd" ); gate_rc=$?; set -e &&
183
187
  if [ "$gate_rc" -eq 0 ]; then
184
188
  printf 'PASS\n' > "$STATUS_FILE";
185
189
  else
@@ -219,7 +223,8 @@ states:
219
223
  mkdir -p .spur/run &&
220
224
  STATUS_FILE=".spur/run/$wbs-test-gate.status" &&
221
225
  set +e &&
222
- ( $qualityGateCmd ); gate_rc=$?; set -e &&
226
+ # See test probe: sh -c for multi-command; qualityGateCmd is trusted config only.
227
+ ( sh -c "$qualityGateCmd" ); gate_rc=$?; set -e &&
223
228
  if [ "$gate_rc" -eq 0 ]; then
224
229
  printf 'PASS\n' > "$STATUS_FILE";
225
230
  else
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@gobing-ai/spur",
3
- "version": "0.3.31",
3
+ "version": "0.3.33",
4
4
  "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
5
5
  "keywords": [
6
6
  "spur",
@@ -50,14 +50,14 @@
50
50
  },
51
51
  "devDependencies": {
52
52
  "@commander-js/extra-typings": "^14.0.0",
53
- "@gobing-ai/ts-db": "^0.4.18",
54
- "@gobing-ai/ts-ai-runner": "^0.4.18",
55
- "@gobing-ai/ts-dual-workflow-engine": "^0.4.18",
56
- "@gobing-ai/ts-infra": "^0.4.18",
57
- "@gobing-ai/ts-llm-jsonl-importer": "^0.4.18",
58
- "@gobing-ai/ts-rule-engine": "^0.4.18",
59
- "@gobing-ai/ts-runtime": "^0.4.18",
60
- "@gobing-ai/ts-utils": "^0.4.18",
53
+ "@gobing-ai/ts-db": "^0.4.19",
54
+ "@gobing-ai/ts-ai-runner": "^0.4.19",
55
+ "@gobing-ai/ts-dual-workflow-engine": "^0.4.19",
56
+ "@gobing-ai/ts-infra": "^0.4.19",
57
+ "@gobing-ai/ts-llm-jsonl-importer": "^0.4.19",
58
+ "@gobing-ai/ts-rule-engine": "^0.4.19",
59
+ "@gobing-ai/ts-runtime": "^0.4.19",
60
+ "@gobing-ai/ts-utils": "^0.4.19",
61
61
  "@types/bun": "1.3.14",
62
62
  "@types/figlet": "^1.7.0",
63
63
  "@types/node-notifier": "8.0.5",