@gobing-ai/spur 0.3.50 → 0.3.51

package/config/rules/quality/coverage-gate.yaml

@@ -2,8 +2,9 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # Coverage gate — per-file line coverage meets threshold from Bun's lcov output.
 # Absorbed from ts-libs/.spur/rules/quality/coverage-gate.yaml, re-scoped to
 # Spur's monorepo layout:
-#   - lcovPath kept at .coverage/lcov.info (Spur's `bun run test` writes
-#     coverage there via --coverage-dir=.coverage)
+#   - lcovPath kept at .coverage/lcov.info (Spur's `bun run test:coverage` —
+#     what `bun run check` and the `*:full` chains run — writes coverage there
+#     via --coverage-dir=.coverage; plain `bun run test` skips coverage)
 #   - include expanded to apps/** + packages/** (Spur tests cover both;
 #     ts-libs only covers packages/**)
 #   - threshold kept at 90 matching bunfig.toml coverageThreshold

package/config/workflows/pr-review.yaml

@@ -43,19 +43,21 @@ terminalStates:
 failureStates:
   - failed
 vars:
-  mode: 'full'
-  baseBranch: ''
-  focus: ''
-  noWait: 'false'
-  waitTimeoutSec: '600'
-  waitIntervalSec: '30'
-  preReviewCmd: ''
-  __runId: ''
+  mode: "full"
+  baseBranch: ""
+  focus: ""
+  noWait: "false"
+  waitTimeoutSec: "600"
+  waitIntervalSec: "30"
+  preReviewCmd: ""
+  __runId: ""
 
 states:
   - id: preflight
     description: >
-      Soft probe: git/gh/repo checks (detached HEAD, dirty tree, gh auth, GitHub remote).
+      Soft probe: git/gh/repo checks (detached HEAD, dirty tree, gh auth, GitHub remote,
+      base-branch refusal — preflight refuses when the current branch IS the resolved base,
+      before any push can publish it).
       Writes PASS|FAIL to .spur/run/${vars.__runId}-pr-preflight.status; always exit 0.
     onEnter:
       - kind: shell
@@ -64,7 +66,7 @@ states:
             mkdir -p .spur/run &&
             STATUS_FILE=".spur/run/$__runId-pr-preflight.status" &&
             set +e &&
-            bun "$(superskill script path sp pr-reviewing.ts)" preflight --json > ".spur/run/$__runId-pr-context.json";
+            bun "$(superskill script path sp pr-reviewing.ts)" preflight --base "$baseBranch" --json > ".spur/run/$__runId-pr-context.json";
             rc=$?; set -e &&
             if [ "$rc" -eq 0 ]; then printf 'PASS\n' > "$STATUS_FILE"; else printf 'FAIL\n' > "$STATUS_FILE"; fi &&
             exit 0
@@ -212,7 +214,7 @@ transitions:
         command: 'test "$(cat .spur/run/$__runId-pr-preflight.status 2>/dev/null)" = PASS'
   - from: preflight
     to: failed
-    description: Preflight red (detached HEAD, dirty tree, gh auth, no GitHub remote) — stop before any publishing
+    description: Preflight red (detached HEAD, dirty tree, gh auth, no GitHub remote, or the current branch being the base branch) — stop before any publishing
     guard:
       kind: always
 

package/config/workflows/task-pipeline.yaml

@@ -85,6 +85,12 @@ vars:
   # TRUSTED CONFIG ONLY — this string is executed via `sh -c` (see test/test-recheck). Never
   # interpolate untrusted operator/LLM input into qualityGateCmd (task 0436 SECUA residual).
   qualityGateCmd: "bun run format && bun run spur-check"
+  # Cheap red-detector run before the full gate on **recheck only**; empty ⇒ no probe
+  # (full gate every recheck — the pre-0587 behavior). A project overriding qualityGateCmd
+  # should override this too. TRUSTED CONFIG ONLY — executed via `sh -c` (same surface as
+  # qualityGateCmd). Invariant: `review` is only ever entered through a full green
+  # qualityGateCmd — only the full gate writes PASS to <wbs>-test-gate.status.
+  gateProbeCmd: "bun run lint"
   # Max /sp:dev-fixall attempts after a red quality-gate probe/recheck (bounded; no thrash).
   # Attempt counter: .spur/run/<wbs>-test-fix-attempt. Default 2 = two fixall hops before failed.
   qualityGateMaxFixAttempts: "2"
@@ -300,7 +306,7 @@ states:
       # `${vars.qualityGateCmd}` at `test` is the gate that actually decides.
       - kind: shell
         options:
-          command: '$formatCmd ; exit 0'
+          command: "$formatCmd ; exit 0"
 
   # ── test hop (quality gate + bounded auto-fix) ─────────────────────────────
   # NOT /sp:dev-unit. That command (sp:code-testing) *extends/generates* tests toward
@@ -389,28 +395,43 @@ states:
       or the pipeline `failed` state (FAIL and attempts exhausted) — never a
       raw lifecycle abort that skips the terminal `failed` state.
     onEnter:
+      # 0587 R3: probe-then-full recheck. A red gateProbeCmd records FAIL and skips the full
+      # gate (the measured waste is re-running a 110–140s gate to learn the tree is still red);
+      # a green probe (or empty gateProbeCmd) falls through to the full-gate loop unchanged.
+      # Only the full gate writes PASS, so the `test-recheck → review` guard (reads PASS)
+      # still means a full green qualityGateCmd ran — invariant preserved by construction.
       - kind: shell
         options:
           command: >-
             mkdir -p .spur/run &&
             STATUS_FILE=".spur/run/$wbs-test-gate.status" &&
             LOG_FILE=".spur/run/$wbs-test-gate.log" &&
+            FINDINGS_FILE=".spur/run/$wbs-test-gate.findings" &&
             : > "$LOG_FILE" &&
-            gate_attempt=1;
-            while [ "$gate_attempt" -le 5 ]; do
-              ATTEMPT_LOG="$LOG_FILE.attempt-$gate_attempt";
-              sh -c "$qualityGateCmd" > "$ATTEMPT_LOG" 2>&1; gate_rc=$?;
-              gate_locked=0;
-              grep -q 'SQLiteError: database is locked' "$ATTEMPT_LOG" && gate_locked=1;
-              cat "$ATTEMPT_LOG" >> "$LOG_FILE";
-              rm -f "$ATTEMPT_LOG";
-              if [ "$gate_rc" -eq 0 ] || [ "$gate_locked" -ne 1 ] || [ "$gate_attempt" -ge 5 ]; then break; fi;
-              printf 'quality gate: database is locked; retrying (%s/5) in 10s\n' "$gate_attempt" | tee -a "$LOG_FILE";
-              sleep 10;
-              gate_attempt=$((gate_attempt + 1));
-            done &&
+            probe_rc=0;
+            if [ -n "$gateProbeCmd" ]; then
+              sh -c "$gateProbeCmd" > "$LOG_FILE.probe" 2>&1; probe_rc=$?;
+              cat "$LOG_FILE.probe" >> "$LOG_FILE";
+              rm -f "$LOG_FILE.probe";
+            fi;
+            if [ "$probe_rc" -ne 0 ]; then
+              gate_rc=$probe_rc;
+            else
+              gate_attempt=1;
+              while [ "$gate_attempt" -le 5 ]; do
+                ATTEMPT_LOG="$LOG_FILE.attempt-$gate_attempt";
+                sh -c "$qualityGateCmd" > "$ATTEMPT_LOG" 2>&1; gate_rc=$?;
+                gate_locked=0;
+                grep -q 'SQLiteError: database is locked' "$ATTEMPT_LOG" && gate_locked=1;
+                cat "$ATTEMPT_LOG" >> "$LOG_FILE";
+                rm -f "$ATTEMPT_LOG";
+                if [ "$gate_rc" -eq 0 ] || [ "$gate_locked" -ne 1 ] || [ "$gate_attempt" -ge 5 ]; then break; fi;
+                printf 'quality gate: database is locked; retrying (%s/5) in 10s\n' "$gate_attempt" | tee -a "$LOG_FILE";
+                sleep 10;
+                gate_attempt=$((gate_attempt + 1));
+              done;
+            fi &&
             cat "$LOG_FILE" &&
-            FINDINGS_FILE=".spur/run/$wbs-test-gate.findings" &&
             set +e; grep -oE '[A-Za-z0-9_./-]+\.[A-Za-z]+:[0-9]+' "$LOG_FILE" | sort -u | head -20 | tr '\n' ' ' > "$FINDINGS_FILE"; set -e &&
             if [ "$gate_rc" -eq 0 ]; then
               printf 'PASS\n' > "$STATUS_FILE";
@@ -709,4 +730,4 @@ transitions:
     guard:
       kind: shell
       options:
-        command: '! $spurBin task check $wbs'
+        command: "! $spurBin task check $wbs"

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.50",
+    "version": "0.3.51",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.50",
+    "version": "0.3.51",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/scripts/pr-reviewing.ts

@@ -88,6 +88,12 @@ interface PreflightContext {
     defaultBranch: string;
 }
 
+interface Upstream {
+    ref: string;
+    ahead: number;
+    behind: number;
+}
+
 interface Finding {
     kind: 'review' | 'inline' | 'comment';
     severity: string;
@@ -433,6 +439,22 @@ function preflightContext(): PreflightContext {
     };
 }
 
+/** Upstream divergence, non-fatal: a missing upstream is a normal state, not an error. */
+function resolveUpstream(): Upstream | null {
+    const refRes = run(['git', 'rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}']);
+    if (refRes.code !== 0) return null;
+    const ref = refRes.stdout.trim();
+    const count = (res: CmdResult): number => {
+        const n = Number(res.stdout.trim());
+        return res.code === 0 && Number.isFinite(n) ? n : 0;
+    };
+    return {
+        ref,
+        ahead: count(run(['git', 'rev-list', '--count', '@{u}..HEAD'])),
+        behind: count(run(['git', 'rev-list', '--count', 'HEAD..@{u}'])),
+    };
+}
+
 function viewPr(): GhPr | null {
     const res = run([
         'gh',
@@ -507,15 +529,27 @@ function cmdPreflight(args: ParsedArgs): void {
             2,
         );
     }
+    const base = (args.flags.get('--base') ?? '').trim() || ctx.defaultBranch;
+    const upstream = resolveUpstream();
+    if (ctx.branch === base) {
+        writeStatus(args, 'FAIL');
+        fail(
+            args,
+            `current branch is the base branch (${base}) — a PR reviews a feature branch against it; ` +
+                'check out a feature branch (nothing on the base branch is reviewable)',
+            2,
+        );
+    }
     writeStatus(args, 'PASS');
     emit(
         args,
-        { ok: true, ...ctx },
+        { ok: true, ...ctx, upstream },
         [
             `Repository: ${ctx.nameWithOwner}`,
             `Branch:     ${ctx.branch}`,
             `HEAD:       ${ctx.shortHead}`,
             `Default:    ${ctx.defaultBranch}`,
+            `Upstream:   ${upstream ? `${upstream.ref} (ahead ${upstream.ahead}, behind ${upstream.behind})` : `none (publishing would create origin/${ctx.branch})`}`,
             'Local:      clean',
         ].join('\n'),
     );

package/plugins/sp/skills/pr-reviewing/SKILL.md

@@ -135,9 +135,12 @@ bun "$(superskill script path sp pr-reviewing.ts)" <subcommand> [flags]
 Installed targets resolve the staged TypeScript source and execute it with Bun, matching the rest
 of `plugins/sp/scripts`.
 
-1. **Preflight** — `<script> preflight --json`. Hard-fails on a
-   detached HEAD, missing `gh` auth, no GitHub remote, or a dirty tree. On a dirty tree, triage
-   with the user (commit/stash/exclude) before continuing — the workflow refuses to guess.
+1. **Preflight** — `<script> preflight --base "$base" --json`. Hard-fails on a
+   detached HEAD, missing `gh` auth, no GitHub remote, a dirty tree, or the current branch
+   being the base branch (a PR reviews a feature branch against the base; nothing on the
+   base branch is reviewable, and the guard runs before any push can publish it). On a
+   dirty tree, triage with the user (commit/stash/exclude) before continuing — the
+   workflow refuses to guess.
 2. **Hygiene** — `<script> hygiene --base "$base" --json`. `BLOCK` (secrets, `.env`, conflict markers,
    private keys) stops the run — never submit a tainted diff. `WARN` (debug residue) rides along
    into the report. This is a submission sanity check, not a second local review.

package/spur.js

@@ -67152,6 +67152,10 @@ var init_finding_codes2 = __esm(() => {
 });
 
 // ../../packages/app/src/services/planning-check-base.ts
+function key(e) {
+  return `${e.kind}:${e.id}:${e.code}`;
+}
+
 class PlanningCheckService {
   fs;
   matrix;
@@ -67244,7 +67248,7 @@ class PlanningCheckService {
       }
     }
   }
-  summarizeWithStatus(status, findings, strict, overrides) {
+  summarizeWithStatus(status, findings, strict, overrides, accepted, id) {
     const effectiveFindings = [];
     for (const f of findings) {
       const override = overrides?.[f.code];
@@ -67257,6 +67261,13 @@ class PlanningCheckService {
       if (strict && f.severity === "warning") {
         f.severity = "error";
       }
+      if (accepted && id) {
+        const k = key({ kind: this.docKind, id, code: f.code });
+        const acceptedSev = accepted.get(k);
+        if (acceptedSev !== undefined && acceptedSev === f.severity) {
+          continue;
+        }
+      }
       effectiveFindings.push(f);
     }
     let hasError = false;
@@ -67877,7 +67888,7 @@ class TaskLocator {
       return;
     }
     const folderKeys = source.foldersConfig ? Object.keys(source.foldersConfig.folders) : [];
-    this.dirs = [...new Set([source.tasksDir, ...folderKeys.map((key) => source.fs.resolve(key))])];
+    this.dirs = [...new Set([source.tasksDir, ...folderKeys.map((key2) => source.fs.resolve(key2))])];
   }
   static forSingleDir(fs3, dir) {
     return new TaskLocator({ fs: fs3, tasksDir: dir });
@@ -68171,7 +68182,10 @@ var init_task_check = __esm(() => {
       const findings = [];
       const doc2 = this.runL1(raw, wbs, findings);
       if (doc2 === null) {
-        return { wbs, ...this.summarizeWithStatus("", findings, strict, options?.severityOverrides) };
+        return {
+          wbs,
+          ...this.summarizeWithStatus("", findings, strict, options?.severityOverrides, options?.accepted, wbs)
+        };
       }
       const fm = doc2.frontmatterData ?? {};
       const status = fm.status ?? "backlog";
@@ -68186,7 +68200,10 @@ var init_task_check = __esm(() => {
       if (status !== "done" && status !== "cancelled") {
         await this.runL4Readiness(doc2, fm, wbs, status, findings, tasksDir);
       }
-      return { wbs, ...this.summarizeWithStatus(status, findings, strict, options?.severityOverrides) };
+      return {
+        wbs,
+        ...this.summarizeWithStatus(status, findings, strict, options?.severityOverrides, options?.accepted, wbs)
+      };
     }
     runL3(doc2, entry, status, findings) {
       const reqBodyRaw = doc2.getSection("Requirements");
@@ -68883,9 +68900,6 @@ import { basename as basename4, dirname as dirname10, join as join11, relative,
 function baselineSeverity(e) {
   return e.severity ?? "error";
 }
-function key(e) {
-  return `${e.kind}:${e.id}:${e.code}`;
-}
 function resolveProjectRoot(cwd) {
   const fs3 = createNodeFileSystem3(cwd);
   let current = resolve3(cwd);
@@ -69253,12 +69267,29 @@ async function runCorpusCheck(cwd, since) {
   }
   return result;
 }
+async function loadAcceptedFindings(cwd) {
+  const projectRoot = resolveProjectRoot(cwd);
+  const baselineFile = join11(projectRoot, "config", "corpus-baseline.json");
+  const accepted = new Map;
+  try {
+    if (await Bun.file(baselineFile).exists()) {
+      const baseline = await Bun.file(baselineFile).json();
+      if (Array.isArray(baseline?.entries)) {
+        for (const e of baseline.entries) {
+          accepted.set(key(e), baselineSeverity(e));
+        }
+      }
+    }
+  } catch {}
+  return accepted;
+}
 var FOG_HEADING, OUT_OF_SCOPE_HEADING, FEATURE_ID, DEFAULT_BRANCHES;
 var init_corpus_check = __esm(() => {
   init_loader();
   init_dist5();
   init_dist2();
   init_feature_check();
+  init_planning_check_base();
   init_task_check();
   init_task_locator();
   FOG_HEADING = /^###\s+Not yet specified\b/;
@@ -79461,6 +79492,7 @@ __export(exports_src2, {
   parseEtimeToSeconds: () => parseEtimeToSeconds,
   normalizeSystemEventPayload: () => normalizeSystemEventPayload,
   normalizeProjectPath: () => normalizeProjectPath,
+  loadAcceptedFindings: () => loadAcceptedFindings,
   isSystemEventEnvelopeV2: () => isSystemEventEnvelopeV2,
   isPortLive: () => isPortLive,
   isPortAvailable: () => isPortAvailable,
@@ -87871,7 +87903,7 @@ import { createRequire } from "module";
 var CLI_CONFIG = {
   binaryName: "spur",
   binaryLabel: "spur",
-  binaryVersion: "0.3.50",
+  binaryVersion: "0.3.51",
   configDir: ".spur",
   configFile: ".spur/config.yaml",
   databaseFile: ".spur/spur.db"
@@ -100429,6 +100461,7 @@ ${result.content}`);
       }
       const svc = await makeCheckService(context4);
       const planningFolders = await resolvePlanningFolders(context4.fs);
+      const accepted = await loadAcceptedFindings(context4.cwd);
       const activeFolder = planningFolders.foldersConfig.active_folder;
       const tasksDir = context4.fs.resolve(options.folder ?? activeFolder);
       const printResult = (result) => {
@@ -100454,7 +100487,8 @@ ${result.wbs} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
         } else {
           const result = await svc.check(hit.filePath, wbs, {
             strict,
-            severityOverrides: planningFolders.severityOverrides
+            severityOverrides: planningFolders.severityOverrides,
+            accepted
           });
           results.push(result);
           printResult(result);
@@ -100471,7 +100505,8 @@ ${result.wbs} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
           }
           const result = await svc.check(`${tasksDir}/${fileName}`, w, {
             strict,
-            severityOverrides: planningFolders.severityOverrides
+            severityOverrides: planningFolders.severityOverrides,
+            accepted
           });
           results.push(result);
           printResult(result);
@@ -100673,14 +100708,20 @@ async function makeCheckService(context4) {
   return new TaskCheckService(context4.fs, await loadSectionMatrix(context4.cwd), await makeTaskLocator(context4));
 }
 async function runDoneGateCheck(context4, wbs, folderOverride) {
-  const foldersConfig = (await resolvePlanningFolders(context4.fs)).foldersConfig;
+  const planningFolders = await resolvePlanningFolders(context4.fs);
+  const foldersConfig = planningFolders.foldersConfig;
   const tasksDir = folderOverride ?? context4.fs.resolve(foldersConfig.active_folder);
   const hit = await new TaskLocator({ fs: context4.fs, tasksDir, foldersConfig }).findByWbs(wbs);
   if (!hit) {
     return false;
   }
   const svc = new TaskCheckService(context4.fs, await loadSectionMatrix(context4.cwd), await makeTaskLocator(context4));
-  const result = await svc.check(hit.filePath, wbs, { strict: false });
+  const accepted = await loadAcceptedFindings(context4.cwd);
+  const result = await svc.check(hit.filePath, wbs, {
+    strict: false,
+    severityOverrides: planningFolders.severityOverrides,
+    accepted
+  });
   return result.pass;
 }
 var sectionMatrixCache = new Map;