@gobing-ai/spur 0.3.76 → 0.3.78

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.76",
+            "version": "0.3.78",
             "source": "./plugins/sp"
         }
     ]

package/config/plugin-scripts.json

@@ -36,6 +36,10 @@
             "contract": "standard",
             "twin": "history-anatomy-cache.mjs"
         },
+        {
+            "rel": "inline-run-setup.ts",
+            "contract": "repo-only"
+        },
         {
             "rel": "inline-pipeline-parity-check.ts",
             "contract": "repo-only"

package/config/rules/strict/runtime-boundaries.yaml

@@ -71,6 +71,7 @@ rules:
             - "packages/config/src/loader.ts" # sync resolveConfigFile() / schema specifier lookup
             - "packages/config/src/executor-update.ts" # atomic single-entry config update (task 0797): O_EXCL lock, fsync'd tmp+rename commit, lstat symlink refusal, mode preservation — ts-runtime FileSystem seam has no lstat/fsync/chmod/O_EXCL
             - "packages/app/src/services/project-start.ts" # sync CLI binary path checks before daemon spawn
+            - "apps/cli/src/commands/serve.ts" # sync resolveServeCwd() directory validation before server startup (task 0805 R2); mirrors task.ts sync-template exemption
 
             # Synchronous template & workflow resolvers:
             - "apps/cli/src/commands/task.ts" # sync loadTemplateContent/Bodies callbacks

package/config/workflows/task-pipeline.yaml

@@ -270,12 +270,20 @@ states:
           # WorkflowAppService.run(); the wbs fallback keeps a driver-less invocation from writing to
           # a bare "-route-reason.txt". The log line carries the run id for the same reason — an
           # unattributed append is log scraping, which R5 explicitly rejects as evidence.
+          # 0804 R8: the run id must be a single safe filename component before it
+          # becomes REASON_FILE — unresolved interpolation ($ { } vars.), path
+          # separators and dot traversal are a failed action (nonzero, no artifact).
+          # NOTE: no `#` comments inside the folded scalar — `>-` joins all same-indent
+          # lines into ONE shell line, so an in-scalar `#` comments out the rest of the
+          # command (the original R8 draft broke exactly this way; the case statement
+          # must stay one line).
           - kind: shell
             options:
                 command: >-
                     mkdir -p .spur/run .spur/memory &&
                     RUN_ID="$__runId" &&
                     if [ -z "$RUN_ID" ]; then RUN_ID="pipeline-$wbs"; fi &&
+                    case "$RUN_ID" in *'$'*|*'{'*|*'}'*|*vars.*|*/*|*'\'*|*..*) echo "route-reason: refusing unsafe run id: $RUN_ID" >&2; exit 1 ;; *) : ;; esac &&
                     REASON_FILE=".spur/run/$RUN_ID-route-reason.txt" &&
                     if [ "$mode" = "fast" ]; then
                       echo "fast:evidence complete+consistent" > "$REASON_FILE";
@@ -335,7 +343,7 @@ states:
                       RETRY_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
                       printf '%s\n' "$RETRY_OUTPUT";
                       if [ "$RETRY_RC" -eq 0 ]; then return 0; fi;
-                      if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked'; then return "$RETRY_RC"; fi;
+                      if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked|SQLite database .*is busy|SQLITE_BUSY'; then return "$RETRY_RC"; fi;
                       sleep 2;
                       RETRY_SECOND_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
                       printf '%s\n' "$RETRY_SECOND_OUTPUT";
@@ -431,7 +439,7 @@ states:
                       ATTEMPT_LOG="$LOG_FILE.attempt-$gate_attempt";
                       sh -c "$qualityGateCmd" > "$ATTEMPT_LOG" 2>&1; gate_rc=$?;
                       gate_locked=0;
-                      grep -q 'SQLiteError: database is locked' "$ATTEMPT_LOG" && gate_locked=1;
+                      grep -Eq 'SQLiteError: database is locked|SQLite database .*is busy|SQLITE_BUSY' "$ATTEMPT_LOG" && gate_locked=1;
                       cat "$ATTEMPT_LOG" >> "$LOG_FILE";
                       rm -f "$ATTEMPT_LOG";
                       if [ "$gate_rc" -eq 0 ] || [ "$gate_locked" -ne 1 ] || [ "$gate_attempt" -ge 5 ]; then break; fi;
@@ -547,7 +555,7 @@ states:
                         ATTEMPT_LOG="$LOG_FILE.attempt-$gate_attempt";
                         sh -c "$qualityGateCmd" > "$ATTEMPT_LOG" 2>&1; gate_rc=$?;
                         gate_locked=0;
-                        grep -q 'SQLiteError: database is locked' "$ATTEMPT_LOG" && gate_locked=1;
+                        grep -Eq 'SQLiteError: database is locked|SQLite database .*is busy|SQLITE_BUSY' "$ATTEMPT_LOG" && gate_locked=1;
                         cat "$ATTEMPT_LOG" >> "$LOG_FILE";
                         rm -f "$ATTEMPT_LOG";
                         if [ "$gate_rc" -eq 0 ] || [ "$gate_locked" -ne 1 ] || [ "$gate_attempt" -ge 5 ]; then break; fi;
@@ -747,7 +755,7 @@ states:
                       RETRY_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
                       printf '%s\n' "$RETRY_OUTPUT";
                       if [ "$RETRY_RC" -eq 0 ]; then return 0; fi;
-                      if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked'; then return "$RETRY_RC"; fi;
+                      if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked|SQLite database .*is busy|SQLITE_BUSY'; then return "$RETRY_RC"; fi;
                       sleep 2;
                       RETRY_SECOND_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
                       printf '%s\n' "$RETRY_SECOND_OUTPUT";
@@ -794,7 +802,7 @@ states:
                       RETRY_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
                       printf '%s\n' "$RETRY_OUTPUT";
                       if [ "$RETRY_RC" -eq 0 ]; then return 0; fi;
-                      if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked'; then return "$RETRY_RC"; fi;
+                      if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked|SQLite database .*is busy|SQLITE_BUSY'; then return "$RETRY_RC"; fi;
                       sleep 2;
                       RETRY_SECOND_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
                       printf '%s\n' "$RETRY_SECOND_OUTPUT";
@@ -1016,8 +1024,13 @@ transitions:
       guard:
           kind: shell
           options:
+              # 0804 R6: `--as done` projects the check onto the done target so open
+              # Plan/AC checkboxes fail HERE — before the done action runs — mirroring
+              # the CLI's own target-aware `--no-lifecycle` backstop (F92 R3). No `#`
+              # comments inside the folded scalar: `>-` joins same-indent lines into
+              # one shell line.
               command: >-
-                  $spurBin task check $wbs &&
+                  $spurBin task check $wbs --as done &&
                   test "$(jq -r .verdict .spur/run/$wbs-verdict.json 2>/dev/null)" = PASS &&
                   test "$(jq -r '.proof.digest // ""' .spur/run/$wbs-verdict.json 2>/dev/null)" = "$proofDigest"
     - from: record

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.76",
+    "version": "0.3.78",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -53,14 +53,14 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.4.57",
-        "@gobing-ai/ts-ai-runner": "^0.4.57",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.4.57",
-        "@gobing-ai/ts-infra": "^0.4.57",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.57",
-        "@gobing-ai/ts-rule-engine": "^0.4.57",
-        "@gobing-ai/ts-runtime": "^0.4.57",
-        "@gobing-ai/ts-utils": "^0.4.57",
+        "@gobing-ai/ts-db": "^0.4.60",
+        "@gobing-ai/ts-ai-runner": "^0.4.60",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.4.60",
+        "@gobing-ai/ts-infra": "^0.4.60",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.60",
+        "@gobing-ai/ts-rule-engine": "^0.4.60",
+        "@gobing-ai/ts-runtime": "^0.4.60",
+        "@gobing-ai/ts-utils": "^0.4.60",
         "@types/bun": "1.3.14",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",

package/plugins/sp/commands/dev-refineall.md

@@ -62,5 +62,6 @@ thread `--depth` into each per-task refine.
 ## Implementation
 
 - Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
+- Apply the [shared startup contract](../skills/spur-dev/references/cross-cutting.md#shared-startup-contract-task-0814-r1r3r4r6r7r8) — bootstrap checklist, quick readiness before isolation, workflow inventory before YAML, comprehensive checks at owning boundaries (task 0814 R1/R3/R4/R7/R8).
 - Batch orchestration: `Skill(skill="sp:spur-dev", args="refineall $ARGUMENTS")`
 - Per-task refine (inner): `Skill(skill="sp:spur-dev", args="refine <wbs> $SHARED_FLAGS")`

package/plugins/sp/commands/dev-run.md

@@ -31,6 +31,7 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 ## Implementation
 
 - Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
+- Apply the [shared startup contract](../skills/spur-dev/references/cross-cutting.md#shared-startup-contract-task-0814-r1r3r4r6r7r8) — bootstrap checklist, quick readiness before isolation, workflow inventory before YAML, comprehensive checks at their owning boundaries (task 0814 R1/R3/R4/R7/R8).
 - Full pipeline (default `--mode full`): interactive omit/`--agent inline` uses the
   [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md) via
   `Skill(skill="sp:spur-dev", args="run-inline $ARGUMENTS")`; `--agent auto` or a named executor

package/plugins/sp/commands/dev-runall.md

@@ -82,5 +82,6 @@ full distinction.
 ## Implementation
 
 - Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface). Interactive sequential omit/`inline` keeps the orchestrator in the host session through the [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md); the resolved selector applies uniformly — eligible `agent.run` stages dispatch once to a native subagent with host fallback (0508). `--agent auto`, a name, or parallel mode retains the isolated per-task workflow boundary.
+- Apply the [shared startup contract](../skills/spur-dev/references/cross-cutting.md#shared-startup-contract-task-0814-r1r3r4r6r7r8) — bootstrap checklist, quick readiness before isolation, workflow inventory before YAML, comprehensive checks at owning boundaries (task 0814 R1/R3/R4/R7/R8).
 - Interactive sequential omit/inline: `Skill(skill="sp:spur-dev", args="runall-inline $ARGUMENTS")`.
 - Explicit executor or parallel mode: `Skill(skill="sp:spur-dev", args="runall $ARGUMENTS")` → `sp:super-planner` agent.

package/plugins/sp/commands/dev-verifyall.md

@@ -68,6 +68,7 @@ Without `--fix all`, shippable is not evaluated (optional note: use `--fix all`
 ## Implementation
 
 - Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
+- Apply the [shared startup contract](../skills/spur-dev/references/cross-cutting.md#shared-startup-contract-task-0814-r1r3r4r6r7r8) — bootstrap checklist, quick readiness before isolation, workflow inventory before YAML, comprehensive checks at owning boundaries (task 0814 R1/R3/R4/R7/R8).
 - Batch orchestration: `Skill(skill="sp:spur-dev", args="verifyall $ARGUMENTS")`
 - Per-task verification (inner): `Skill(skill="sp:code-verification", args="verify <wbs> $SHARED_FLAGS")`
 - Shippable gate: once after the batch (same skill § Shippable readiness gate)

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.76",
+    "version": "0.3.78",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/scripts/batch-preflight.mjs

@@ -3,6 +3,119 @@ import { createRequire } from "node:module";
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // plugins/sp/scripts/batch-preflight.ts
+function quickReadiness(input) {
+  const status = (input.status ?? "").toLowerCase();
+  const operation = input.operation;
+  if (operation !== "run" && operation !== "refine" && operation !== "verify") {
+    return {
+      action: "invalid",
+      code: "IV",
+      reason: `quick-readiness: unknown operation '${operation}' (${input.wbs})`
+    };
+  }
+  if (input.filteredCount !== undefined) {
+    if (input.filteredCount < 0) {
+      return {
+        action: "invalid",
+        code: "IV",
+        reason: `quick-readiness: invalid negative filtered count '${input.filteredCount}' (${input.wbs})`
+      };
+    }
+    if (input.filteredCount === 0) {
+      return {
+        action: "skipped",
+        code: "EMPTY",
+        reason: `quick-readiness: empty status-filtered set — nothing to ${operation} (${input.wbs})`
+      };
+    }
+  }
+  if (status === "cancelled" || status === "done") {
+    if (operation === "verify" && input.force === true) {
+      return {
+        action: "runnable",
+        code: "FORCE",
+        reason: `quick-readiness: verify --force re-verification of ${status} task ${input.wbs}`
+      };
+    }
+    return {
+      action: "skipped",
+      code: status === "done" ? "DONE" : "CANCELLED",
+      reason: `quick-readiness: already ${status} — no ${operation} hop (${input.wbs})`
+    };
+  }
+  if (status === "blocked") {
+    return {
+      action: "blocked",
+      code: "BLK",
+      reason: `quick-readiness: blocked — human/handover first (${input.wbs})`
+    };
+  }
+  if (operation === "run" && input.dependencies && input.dependencies.length > 0) {
+    const unmet = input.dependencies.filter((d) => (input.depStatuses?.[d] ?? "missing").toLowerCase() !== "done");
+    if (unmet.length > 0) {
+      return {
+        action: "blocked",
+        code: "DEP",
+        reason: `quick-readiness: unmet deps — ${unmet.join(", ")} (${input.wbs})`,
+        unmetDeps: unmet
+      };
+    }
+  }
+  const required = input.requiredSections ?? [];
+  const present = input.presentSections ?? [];
+  const gaps = required.filter((s) => {
+    const finding = input.sectionFindings?.[s];
+    return !present.includes(s) || finding !== undefined && finding !== "";
+  });
+  if (operation === "refine") {
+    if (status !== "backlog" && status !== "todo") {
+      return {
+        action: "skipped",
+        code: "NONPLAN",
+        reason: `quick-readiness: refine targets backlog/todo only, not '${status}' (${input.wbs})`
+      };
+    }
+    return {
+      action: "runnable",
+      code: "OK",
+      reason: `quick-readiness: refine ready for ${input.wbs} (${gaps.length} planning gap(s) to fill)`
+    };
+  }
+  if (operation === "verify") {
+    if (status !== "testing" && status !== "wip") {
+      return {
+        action: "invalid",
+        code: "NOVERIFY",
+        reason: `quick-readiness: verify needs testing/wip, not '${status}' (${input.wbs})`
+      };
+    }
+    return {
+      action: "runnable",
+      code: "OK",
+      reason: `quick-readiness: verify ready for ${input.wbs}`
+    };
+  }
+  if (status !== "todo" && status !== "wip" && status !== "testing") {
+    return {
+      action: "invalid",
+      code: "NORUN",
+      reason: `quick-readiness: run needs todo/wip/testing, not '${status}' (${input.wbs})`
+    };
+  }
+  if (gaps.length > 0) {
+    return {
+      action: "needs-refinement",
+      code: "REFINE",
+      reason: `quick-readiness: implementation sections incomplete (${input.wbs})`,
+      gaps
+    };
+  }
+  return {
+    action: "runnable",
+    code: "OK",
+    reason: `quick-readiness: run ready for ${input.wbs}`
+  };
+}
 function preflightTask(input) {
   const status = (input.status ?? "").toLowerCase();
   const deps = input.dependencies ?? [];
@@ -72,6 +185,11 @@ function parsePreflightCliArgs(argv) {
   let recovery = false;
   let help = false;
   let json = false;
+  let operation = null;
+  let force = false;
+  let filteredCount = null;
+  let requiredSections = [];
+  let presentSections = [];
   for (let i = 0;i < argv.length; i++) {
     const a = argv[i];
     if (a === "--help" || a === "-h")
@@ -80,7 +198,21 @@ function parsePreflightCliArgs(argv) {
       json = true;
     else if (a === "--recovery")
       recovery = true;
-    else if (a === "--wbs")
+    else if (a === "--force")
+      force = true;
+    else if (a === "--operation") {
+      const v = argv[++i] ?? "";
+      operation = v === "run" || v === "refine" || v === "verify" ? v : null;
+    } else if (a === "--filtered-count") {
+      const v = Number(argv[++i]);
+      filteredCount = Number.isFinite(v) ? v : null;
+    } else if (a === "--required-sections") {
+      const raw = argv[++i] ?? "";
+      requiredSections = raw.length === 0 ? [] : raw.split(",").map((s) => s.trim()).filter(Boolean);
+    } else if (a === "--present-sections") {
+      const raw = argv[++i] ?? "";
+      presentSections = raw.length === 0 ? [] : raw.split(",").map((s) => s.trim()).filter(Boolean);
+    } else if (a === "--wbs")
       wbs = argv[++i] ?? wbs;
     else if (a === "--status")
       status = argv[++i] ?? null;
@@ -96,11 +228,25 @@ function parsePreflightCliArgs(argv) {
       }
     }
   }
-  return { status, deps, depStatuses, wbs, recovery, help, json };
+  return {
+    status,
+    deps,
+    depStatuses,
+    wbs,
+    recovery,
+    help,
+    json,
+    operation,
+    force,
+    filteredCount,
+    requiredSections,
+    presentSections
+  };
 }
 var PREFLIGHT_CLI_USAGE = `Usage:
   bun plugins/sp/scripts/batch-preflight.ts --wbs <wbs> --status <status> \\
     [--deps 0275,0276] [--dep-status 0275:done,0276:todo] [--recovery] [--json]
+  bun plugins/sp/scripts/batch-preflight.ts --operation <run|refine|verify> --wbs <wbs> --status <status>     [--filtered-count <n>] [--required-sections A,B] [--present-sections A,B] [--force] [--json]
 
 Exit: 0 = run (or recovery hint printed); 2 = skip; 1 = usage.`;
 function runPreflightCli(argv) {
@@ -117,6 +263,30 @@ function runPreflightCli(argv) {
 `;
     return { exitCode: 0, stdout: body, stderr: "" };
   }
+  if (args.operation !== null) {
+    const result2 = quickReadiness({
+      wbs: args.wbs,
+      status: args.status,
+      operation: args.operation,
+      dependencies: args.deps,
+      depStatuses: args.depStatuses,
+      ...args.filteredCount !== null ? { filteredCount: args.filteredCount } : {},
+      ...args.requiredSections.length > 0 ? { requiredSections: args.requiredSections } : {},
+      ...args.presentSections.length > 0 ? { presentSections: args.presentSections } : {},
+      ...args.force ? { force: true } : {}
+    });
+    const runnable = result2.action === "runnable" || result2.action === "needs-refinement";
+    if (args.json) {
+      return { exitCode: runnable ? 0 : 2, stdout: `${JSON.stringify(result2, null, 2)}
+`, stderr: "" };
+    }
+    return {
+      exitCode: runnable ? 0 : 2,
+      stdout: `${result2.action}${result2.code ? ` ${result2.code}` : ""}: ${result2.reason}
+`,
+      stderr: ""
+    };
+  }
   const result = preflightTask({
     wbs: args.wbs,
     status: args.status,
@@ -154,6 +324,7 @@ function runPreflightCli(argv) {
 export {
   runPreflightCli,
   recoveryHint,
+  quickReadiness,
   preflightTask,
   parsePreflightCliArgs,
   PREFLIGHT_CLI_USAGE