@gobing-ai/spur 0.3.88 → 0.3.89

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.88",
+            "version": "0.3.89",
             "source": "./plugins/sp"
         }
     ]

package/config/rules/boundary/env-var-hygiene.yaml

@@ -9,16 +9,18 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 #   Env flows into the app as typed config or injected `env` records (ADR-027). Runtime
 #   options belong in `.spur/config.yaml` `bootstrap.options` via `getAppOptions`;
 #   dev-only knobs belong in consts.
-# - Plugin scripts/hooks import the same functions from `@gobing-ai/ts-utils`; the
-#   `superskill script convert` `.mjs` twins bundle them in (self-contained on any
-#   install target).
+# - Plugin scripts/hooks import `plugins/sp/lib/env.ts` — the vendored standalone
+#   gateway — because `superskill install` bundles them on targets with no
+#   node_modules, where any `@gobing-ai/*` import fails ("Bundle failed", task
+#   0669). It mirrors the upstream semantics and is the one exempt file.
+#   The `superskill script convert` `.mjs` twins remain self-contained by inlining.
 # - `apps/web` uses `import.meta.env` (Vite browser plane) — not process env, never matches.
 # - Which variables exist and who consumes them is documented in `.env.example`.
 #   (The former per-var lease table moved there; the rule now enforces the funnel,
 #   not a file-by-var inventory.)
 #
-# Scope: apps/**, packages/**, scripts/**, plugins/sp/** — src AND tests. No exclusions:
-# even the gateway package itself is free of direct access.
+# Scope: apps/**, packages/**, scripts/**, plugins/sp/** — src AND tests. One exclusion:
+# the plugin's vendored gateway, whose sole job is direct `process.env` access.
 include:
   - "apps/**/src/**/*.{ts,tsx}"
   - "apps/**/tests/**/*.{ts,tsx}"
@@ -26,6 +28,12 @@ include:
   - "packages/**/tests/**/*.{ts,tsx}"
   - "scripts/**/*.ts"
   - "plugins/sp/**/*.ts"
+exclude:
+  # plugins/sp/lib/env.ts is the vendored standalone env gateway for plugin
+  # hooks/scripts (bundled by superskill onto targets without node_modules);
+  # direct process.env access is its entire purpose. Mirrors the upstream
+  # ts-utils gateway — keep in sync (verified 2026-09).
+  - "plugins/sp/lib/env.ts"
 rules:
   - id: env-var-hygiene
     description: >

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.88",
+    "version": "0.3.89",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/plugins/sp/hooks/agent-hint.ts

@@ -1,4 +1,4 @@
-import { getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVars } from '../lib/env';
 /**
  * Shared host-agent identification helpers — the **only** host-agent detection path
  * in the sp plugin hooks.

package/plugins/sp/hooks/careful-guard.ts

@@ -22,7 +22,7 @@
  * adapter. This file owns the Claude Code payload/decision shape only.
  */
 
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 import { classifyCommand } from './destructive-policy';
 
 interface ToolPayload {

package/plugins/sp/hooks/context-post-tool.ts

@@ -23,7 +23,7 @@
 import { execSync } from 'node:child_process';
 import { appendFileSync, existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { join, resolve, sep } from 'node:path';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 /** Tools recorded by this hook (must match hooks.json PostToolUse matcher). */
 export const ALLOWED_TOOLS = new Set(['Bash', 'Grep', 'Glob', 'Read', 'Write', 'Edit']);

package/plugins/sp/hooks/context-session-start.ts

@@ -15,7 +15,7 @@
 import { execSync } from 'node:child_process';
 import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { getEnvVar, getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVar, getEnvVars } from '../lib/env';
 import { resolveAgentHint, resolveModelHint } from './agent-hint';
 import { checkContextFreshness } from './context-post-tool';
 

package/plugins/sp/hooks/context-session-stop.ts

@@ -17,7 +17,7 @@
 
 import { appendFileSync, existsSync, readFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 interface LedgerEvent {
     session: string;

package/plugins/sp/hooks/pi/guard-extension.ts

@@ -23,7 +23,7 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync, realpathSync, rmSy
 import { homedir } from 'node:os';
 import { isAbsolute, join, resolve } from 'node:path';
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
-import { getEnvVar, getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVar, getEnvVars } from '../../lib/env';
 import { resolveAgentHint as resolveAgentHintShared, resolveModelHint as resolveModelHintShared } from '../agent-hint';
 import { classifyCommand } from '../destructive-policy';
 import { couldBeTaskFile } from '../task-file-policy';

package/plugins/sp/hooks/task-write-guard.ts

@@ -20,7 +20,7 @@
  */
 
 import { spawnSync } from 'node:child_process';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 import { couldBeTaskFile } from './task-file-policy';
 
 interface ToolPayload {

package/plugins/sp/lib/env.ts

@@ -0,0 +1,46 @@
+/**
+ * Vendored env gateway for the sp plugin.
+ *
+ * WHY this copy exists: hooks and scripts in this plugin are bundled
+ * standalone by `superskill install` on targets that have no node_modules —
+ * any `@gobing-ai/*` import fails to resolve there and aborts the install
+ * ("Bundle failed", task 0669). This file mirrors the semantics of the
+ * canonical gateway (`@gobing-ai/ts-utils` dist/env, ts-libs) so the plugin
+ * stays self-contained. Keep in sync when the upstream gateway changes.
+ *
+ * These accessors are node-bun only: on `cloudflare-workers` there is no
+ * `process`; inject config explicitly rather than calling them (ADR-008).
+ */
+
+/**
+ * Read one environment variable. Only an unset variable yields `fallback`;
+ * an empty string is a set value and is returned as-is.
+ */
+export function getEnvVar(name: string, fallback?: string): string | undefined {
+    const raw = process.env[name];
+    return raw === undefined ? fallback : raw;
+}
+
+/**
+ * Read the live environment as a record. The returned object IS `process.env`
+ * (not a copy): whole-record operations see later mutations, which child-spawn
+ * composition relies on. For single variables prefer {@link getEnvVar}.
+ */
+export function getEnvVars(): Record<string, string | undefined> {
+    return process.env;
+}
+
+/**
+ * Set one environment variable through the gateway. Passing `undefined` removes
+ * the key, so the save/restore idiom (`const prev = getEnvVar(k); …
+ * setEnvVar(k, prev)`) restores absence exactly.
+ */
+export function setEnvVar(name: string, value: string | undefined): void {
+    if (value === undefined) delete process.env[name];
+    else process.env[name] = value;
+}
+
+/** Remove one environment variable; a no-op when the key is absent. */
+export function removeEnvVar(name: string): void {
+    delete process.env[name];
+}

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.88",
+    "version": "0.3.89",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/scripts/daily-summary/daily-summary.mjs

@@ -8,7 +8,7 @@ import { spawn, spawnSync } from "child_process";
 import { existsSync, mkdirSync, readlinkSync, writeFileSync } from "fs";
 import { dirname, isAbsolute, join, resolve } from "path";
 
-// ../ts-libs/packages/utils/dist/env.js
+// plugins/sp/lib/env.ts
 function getEnvVar(name, fallback) {
   const raw = process.env[name];
   return raw === undefined ? fallback : raw;

package/plugins/sp/scripts/daily-summary/daily-summary.ts

@@ -11,7 +11,7 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, readlinkSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
-import { getEnvVar, getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVar, getEnvVars } from '../../lib/env';
 
 import { logger } from './logger';
 

package/plugins/sp/scripts/feature-sync-bounded.mjs

@@ -9,7 +9,7 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSy
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 
-// ../ts-libs/packages/utils/dist/env.js
+// plugins/sp/lib/env.ts
 function getEnvVar(name, fallback) {
   const raw = process.env[name];
   return raw === undefined ? fallback : raw;

package/plugins/sp/scripts/feature-sync-bounded.ts

@@ -24,7 +24,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 // ── Local types (match packages/app FeatureService shapes; no package import) ───────────
 

package/plugins/sp/scripts/idea-handoff.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // @bun
 
-// ../ts-libs/packages/utils/dist/env.js
+// plugins/sp/lib/env.ts
 function getEnvVars() {
   return process.env;
 }

package/plugins/sp/scripts/idea-handoff.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 
-import { getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVars } from '../lib/env';
 
 /**
  * idea-handoff — portable entrypoint for the idea-pipeline finalization (task 0824, feature I21).

package/plugins/sp/scripts/inline-run-setup.ts

@@ -52,7 +52,7 @@
 import { appendFileSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 /** Outcome document written to `.spur/run/<run-id>-inline-setup.json`. */
 interface SetupOutcome {

package/plugins/sp/scripts/pr-reviewing.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from "child_process";
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
 
-// ../ts-libs/packages/utils/dist/env.js
+// plugins/sp/lib/env.ts
 function getEnvVars() {
   return process.env;
 }

package/plugins/sp/scripts/pr-reviewing.ts

@@ -22,7 +22,7 @@
 import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVars } from '../lib/env';
 
 // ─── Types ──────────────────────────────────────────────────────────────────
 

package/plugins/sp/scripts/quality-gate.mjs

@@ -18,7 +18,7 @@ import {
 import { tmpdir } from "os";
 import { join } from "path";
 
-// ../ts-libs/packages/utils/dist/env.js
+// plugins/sp/lib/env.ts
 function getEnvVars() {
   return process.env;
 }

package/plugins/sp/scripts/quality-gate.ts

@@ -41,7 +41,7 @@ import {
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVars } from '../lib/env';
 
 export const MAX_GATE_ATTEMPTS = 5;
 export const MAX_FINDINGS = 20;

package/plugins/sp/scripts/task-evidence-precheck.ts

@@ -37,7 +37,7 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 /** Exact task-content declaration that activates the live-evidence gate (0726 R2). */
 const DECLARATION_PREFIX = 'evidence-channel:';

package/plugins/sp/scripts/task-size-precheck.ts

@@ -26,7 +26,7 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 // ─── Counting (sync with packages/app/src/services/task-size-precheck.ts) ────
 

package/plugins/sp/scripts/verify-answer-lint.ts

@@ -32,7 +32,7 @@
 import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 // ─── CLI (same spur-bin chain as task-evidence-precheck.ts) ─────────────────
 

package/plugins/sp/scripts/workflow-step-profile.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from "child_process";
 import { existsSync } from "fs";
 import { fileURLToPath } from "url";
 
-// ../ts-libs/packages/utils/dist/env.js
+// plugins/sp/lib/env.ts
 function getEnvVar(name, fallback) {
   const raw = process.env[name];
   return raw === undefined ? fallback : raw;

package/plugins/sp/scripts/workflow-step-profile.ts

@@ -25,7 +25,7 @@
 import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 // ── Input shapes (a subset of the live `spur workflow trace --json` payload) ─────────────
 

package/plugins/sp/scripts/wrapup-steps.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from "child_process";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
 
-// ../ts-libs/packages/utils/dist/env.js
+// plugins/sp/lib/env.ts
 function getEnvVars() {
   return process.env;
 }

package/plugins/sp/scripts/wrapup-steps.ts

@@ -31,7 +31,7 @@
 import { spawnSync } from 'node:child_process';
 import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVars } from '../lib/env';
 
 export interface WrapupStepsEnv {
     __runId?: string;

package/spur.js

@@ -111242,13 +111242,13 @@ async function run(repoRoot, cmd) {
     stderr: result.stderr.toString().trim()
   };
 }
-function verifyLockfile(ctx, output2) {
+async function verifyLockfile(ctx, output2) {
   const lockPath = join38(ctx.repoRoot, "bun.lock");
   if (!existsSync13(lockPath) || Bun.file(lockPath).size === 0)
     return;
-  const result = Bun.spawnSync(["bun", "install", "--frozen-lockfile"], { cwd: ctx.repoRoot });
-  if (result.exitCode !== 0) {
-    throw new Error(`bun install --frozen-lockfile failed after bump \u2014 bun.lock is inconsistent: ${result.stderr.toString().trim()}`);
+  const result = await run(ctx.repoRoot, ["bun", "install", "--frozen-lockfile"]);
+  if (!result.ok) {
+    throw new Error(`bun install --frozen-lockfile failed after bump \u2014 bun.lock is inconsistent: ${result.stderr}`);
   }
   output2.write("  \u21B3 bun.lock: verified (bun install --frozen-lockfile)");
 }
@@ -111520,7 +111520,7 @@ async function bumpVersion(ctx, config4, version3, options, output2) {
   staged.push(...await updateWorkspacePins(ctx, config4.packageName, previous, version3, output2));
   await syncMarketplaceAndPlugins(ctx, version3, staged, output2);
   await syncExtraCarriers(ctx, version3, staged, output2);
-  verifyLockfile(ctx, output2);
+  await verifyLockfile(ctx, output2);
   const lockPath = join38(ctx.repoRoot, "bun.lock");
   if (existsSync13(lockPath) && Bun.file(lockPath).size > 0)
     staged.push("bun.lock");
@@ -111597,7 +111597,7 @@ async function bumpAll(ctx, version3, options, output2) {
   }
   await syncMarketplaceAndPlugins(ctx, version3, staged, output2);
   await syncExtraCarriers(ctx, version3, staged, output2);
-  verifyLockfile(ctx, output2);
+  await verifyLockfile(ctx, output2);
   const lockPath = join38(ctx.repoRoot, "bun.lock");
   if (existsSync13(lockPath) && Bun.file(lockPath).size > 0)
     staged.push("bun.lock");
@@ -112205,7 +112205,7 @@ import { createRequire } from "module";
 var CLI_CONFIG = {
   binaryName: "spur",
   binaryLabel: "spur",
-  binaryVersion: "0.3.88",
+  binaryVersion: "0.3.89",
   configDir: ".spur",
   configFile: ".spur/config.yaml",
   databaseFile: ".spur/spur.db"