@gobing-ai/spur 0.3.88 → 0.3.90

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.88",
+            "version": "0.3.90",
             "source": "./plugins/sp"
         }
     ]

package/config/rules/boundary/env-var-hygiene.yaml

@@ -9,16 +9,18 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 #   Env flows into the app as typed config or injected `env` records (ADR-027). Runtime
 #   options belong in `.spur/config.yaml` `bootstrap.options` via `getAppOptions`;
 #   dev-only knobs belong in consts.
-# - Plugin scripts/hooks import the same functions from `@gobing-ai/ts-utils`; the
-#   `superskill script convert` `.mjs` twins bundle them in (self-contained on any
-#   install target).
+# - Plugin scripts/hooks import `plugins/sp/lib/env.ts` — the vendored standalone
+#   gateway — because `superskill install` bundles them on targets with no
+#   node_modules, where any `@gobing-ai/*` import fails ("Bundle failed", task
+#   0669). It mirrors the upstream semantics and is the one exempt file.
+#   The `superskill script convert` `.mjs` twins remain self-contained by inlining.
 # - `apps/web` uses `import.meta.env` (Vite browser plane) — not process env, never matches.
 # - Which variables exist and who consumes them is documented in `.env.example`.
 #   (The former per-var lease table moved there; the rule now enforces the funnel,
 #   not a file-by-var inventory.)
 #
-# Scope: apps/**, packages/**, scripts/**, plugins/sp/** — src AND tests. No exclusions:
-# even the gateway package itself is free of direct access.
+# Scope: apps/**, packages/**, scripts/**, plugins/sp/** — src AND tests. One exclusion:
+# the plugin's vendored gateway, whose sole job is direct `process.env` access.
 include:
   - "apps/**/src/**/*.{ts,tsx}"
   - "apps/**/tests/**/*.{ts,tsx}"
@@ -26,6 +28,12 @@ include:
   - "packages/**/tests/**/*.{ts,tsx}"
   - "scripts/**/*.ts"
   - "plugins/sp/**/*.ts"
+exclude:
+  # plugins/sp/lib/env.ts is the vendored standalone env gateway for plugin
+  # hooks/scripts (bundled by superskill onto targets without node_modules);
+  # direct process.env access is its entire purpose. Mirrors the upstream
+  # ts-utils gateway — keep in sync (verified 2026-09).
+  - "plugins/sp/lib/env.ts"
 rules:
   - id: env-var-hygiene
     description: >

package/config/rules/boundary/sp-plugin-standalone.yaml

@@ -0,0 +1,37 @@
+$schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
+# Plugin standalone contract — bundled plugin surfaces import only node:* or relative paths.
+#
+# WHY: `superskill install` bundles plugins/sp hooks and scripts on targets (and from
+# marketplace snapshots) with NO node_modules. A bare `@gobing-ai/*` value import only
+# converts if the host superskill happens to carry that package in its private dep tree
+# (superskill 0.3.28+ bundles ts-utils/ts-runtime; older versions do not). When it does
+# not: "Error: Bundle failed" and the plugin cannot install — this broke releases
+# 0.3.81–0.3.88 (task 0669; regression commit 84c87a9ac).
+#
+# Contract:
+# - plugins/sp/hooks/**, plugins/sp/scripts/**, plugins/sp/lib/** may value-import
+#   only `node:*` builtins and relative paths (vendored helpers live in plugins/sp/lib/).
+# - `import type` / `export type` from any package is fine — erased before bundling
+#   (e.g. inline-run-setup.ts's type-only import from @gobing-ai/app).
+# - This rule is the author-time tripwire over DIRECT imports; the transitive closure
+#   and the real `superskill install` path are checked by `bun run plugin-smoke`, and
+#   script-contract-check Rule 5 (manifest-aware) fails the spur-check gate.
+#
+# Scope: plugins/sp bundled surfaces only. apps/packages follow the normal workspace
+# import rules and are not affected.
+include:
+  - "plugins/sp/hooks/**/*.ts"
+  - "plugins/sp/scripts/**/*.ts"
+  - "plugins/sp/lib/**/*.ts"
+rules:
+  - id: sp-plugin-standalone
+    description: >
+      No value imports of workspace packages (`@gobing-ai/*` or any bare specifier)
+      in plugin bundled surfaces — superskill bundles them onto targets with no
+      node_modules. Vendor the helper into plugins/sp/lib/ (see lib/env.ts) or use a
+      relative import. `import type` is exempt.
+    severity: error
+    evaluator:
+      type: rg
+      config:
+        pattern: "^import \\{[^}]*\\} from ['\\\"]@gobing-ai/|^import ['\\\"]@gobing-ai/|^import\\(['\\\"]@gobing-ai/|^} from ['\\\"]@gobing-ai/"

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.88",
+    "version": "0.3.90",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -53,14 +53,14 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.4.69",
-        "@gobing-ai/ts-ai-runner": "^0.4.69",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.4.69",
-        "@gobing-ai/ts-infra": "^0.4.69",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.69",
-        "@gobing-ai/ts-rule-engine": "^0.4.69",
-        "@gobing-ai/ts-runtime": "^0.4.69",
-        "@gobing-ai/ts-utils": "^0.4.69",
+        "@gobing-ai/ts-db": "^0.5.0",
+        "@gobing-ai/ts-ai-runner": "^0.5.0",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.5.0",
+        "@gobing-ai/ts-infra": "^0.5.0",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.0",
+        "@gobing-ai/ts-rule-engine": "^0.5.0",
+        "@gobing-ai/ts-runtime": "^0.5.0",
+        "@gobing-ai/ts-utils": "^0.5.0",
         "@types/bun": "1.3.14",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",

package/plugins/sp/hooks/agent-hint.ts

@@ -1,4 +1,4 @@
-import { getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVars } from '../lib/env';
 /**
  * Shared host-agent identification helpers — the **only** host-agent detection path
  * in the sp plugin hooks.

package/plugins/sp/hooks/careful-guard.ts

@@ -22,7 +22,7 @@
  * adapter. This file owns the Claude Code payload/decision shape only.
  */
 
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 import { classifyCommand } from './destructive-policy';
 
 interface ToolPayload {

package/plugins/sp/hooks/context-post-tool.ts

@@ -23,7 +23,7 @@
 import { execSync } from 'node:child_process';
 import { appendFileSync, existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { join, resolve, sep } from 'node:path';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 /** Tools recorded by this hook (must match hooks.json PostToolUse matcher). */
 export const ALLOWED_TOOLS = new Set(['Bash', 'Grep', 'Glob', 'Read', 'Write', 'Edit']);

package/plugins/sp/hooks/context-session-start.ts

@@ -15,7 +15,7 @@
 import { execSync } from 'node:child_process';
 import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { getEnvVar, getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVar, getEnvVars } from '../lib/env';
 import { resolveAgentHint, resolveModelHint } from './agent-hint';
 import { checkContextFreshness } from './context-post-tool';
 

package/plugins/sp/hooks/context-session-stop.ts

@@ -17,7 +17,7 @@
 
 import { appendFileSync, existsSync, readFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 interface LedgerEvent {
     session: string;

package/plugins/sp/hooks/pi/guard-extension.ts

@@ -23,7 +23,7 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync, realpathSync, rmSy
 import { homedir } from 'node:os';
 import { isAbsolute, join, resolve } from 'node:path';
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
-import { getEnvVar, getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVar, getEnvVars } from '../../lib/env';
 import { resolveAgentHint as resolveAgentHintShared, resolveModelHint as resolveModelHintShared } from '../agent-hint';
 import { classifyCommand } from '../destructive-policy';
 import { couldBeTaskFile } from '../task-file-policy';

package/plugins/sp/hooks/task-write-guard.ts

@@ -20,7 +20,7 @@
  */
 
 import { spawnSync } from 'node:child_process';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 import { couldBeTaskFile } from './task-file-policy';
 
 interface ToolPayload {

package/plugins/sp/lib/env.ts

@@ -0,0 +1,46 @@
+/**
+ * Vendored env gateway for the sp plugin.
+ *
+ * WHY this copy exists: hooks and scripts in this plugin are bundled
+ * standalone by `superskill install` on targets that have no node_modules —
+ * any `@gobing-ai/*` import fails to resolve there and aborts the install
+ * ("Bundle failed", task 0669). This file mirrors the semantics of the
+ * canonical gateway (`@gobing-ai/ts-utils` dist/env, ts-libs) so the plugin
+ * stays self-contained. Keep in sync when the upstream gateway changes.
+ *
+ * These accessors are node-bun only: on `cloudflare-workers` there is no
+ * `process`; inject config explicitly rather than calling them (ADR-008).
+ */
+
+/**
+ * Read one environment variable. Only an unset variable yields `fallback`;
+ * an empty string is a set value and is returned as-is.
+ */
+export function getEnvVar(name: string, fallback?: string): string | undefined {
+    const raw = process.env[name];
+    return raw === undefined ? fallback : raw;
+}
+
+/**
+ * Read the live environment as a record. The returned object IS `process.env`
+ * (not a copy): whole-record operations see later mutations, which child-spawn
+ * composition relies on. For single variables prefer {@link getEnvVar}.
+ */
+export function getEnvVars(): Record<string, string | undefined> {
+    return process.env;
+}
+
+/**
+ * Set one environment variable through the gateway. Passing `undefined` removes
+ * the key, so the save/restore idiom (`const prev = getEnvVar(k); …
+ * setEnvVar(k, prev)`) restores absence exactly.
+ */
+export function setEnvVar(name: string, value: string | undefined): void {
+    if (value === undefined) delete process.env[name];
+    else process.env[name] = value;
+}
+
+/** Remove one environment variable; a no-op when the key is absent. */
+export function removeEnvVar(name: string): void {
+    delete process.env[name];
+}