@gobing-ai/spur 0.3.88 → 0.3.90

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.88",
+    "version": "0.3.90",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/scripts/daily-summary/daily-summary.mjs

@@ -8,7 +8,7 @@ import { spawn, spawnSync } from "child_process";
 import { existsSync, mkdirSync, readlinkSync, writeFileSync } from "fs";
 import { dirname, isAbsolute, join, resolve } from "path";
 
-// ../ts-libs/packages/utils/dist/env.js
+// plugins/sp/lib/env.ts
 function getEnvVar(name, fallback) {
   const raw = process.env[name];
   return raw === undefined ? fallback : raw;

package/plugins/sp/scripts/daily-summary/daily-summary.ts

@@ -11,7 +11,7 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, readlinkSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
-import { getEnvVar, getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVar, getEnvVars } from '../../lib/env';
 
 import { logger } from './logger';
 

package/plugins/sp/scripts/feature-sync-bounded.mjs

@@ -9,7 +9,7 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSy
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 
-// ../ts-libs/packages/utils/dist/env.js
+// plugins/sp/lib/env.ts
 function getEnvVar(name, fallback) {
   const raw = process.env[name];
   return raw === undefined ? fallback : raw;

package/plugins/sp/scripts/feature-sync-bounded.ts

@@ -24,7 +24,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 // ── Local types (match packages/app FeatureService shapes; no package import) ───────────
 

package/plugins/sp/scripts/idea-handoff.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // @bun
 
-// ../ts-libs/packages/utils/dist/env.js
+// plugins/sp/lib/env.ts
 function getEnvVars() {
   return process.env;
 }

package/plugins/sp/scripts/idea-handoff.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 
-import { getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVars } from '../lib/env';
 
 /**
  * idea-handoff — portable entrypoint for the idea-pipeline finalization (task 0824, feature I21).

package/plugins/sp/scripts/inline-run-setup.ts

@@ -52,7 +52,7 @@
 import { appendFileSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 /** Outcome document written to `.spur/run/<run-id>-inline-setup.json`. */
 interface SetupOutcome {

package/plugins/sp/scripts/pr-reviewing.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from "child_process";
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
 
-// ../ts-libs/packages/utils/dist/env.js
+// plugins/sp/lib/env.ts
 function getEnvVars() {
   return process.env;
 }

package/plugins/sp/scripts/pr-reviewing.ts

@@ -22,7 +22,7 @@
 import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVars } from '../lib/env';
 
 // ─── Types ──────────────────────────────────────────────────────────────────
 

package/plugins/sp/scripts/quality-gate.mjs

@@ -18,7 +18,7 @@ import {
 import { tmpdir } from "os";
 import { join } from "path";
 
-// ../ts-libs/packages/utils/dist/env.js
+// plugins/sp/lib/env.ts
 function getEnvVars() {
   return process.env;
 }

package/plugins/sp/scripts/quality-gate.ts

@@ -41,7 +41,7 @@ import {
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVars } from '../lib/env';
 
 export const MAX_GATE_ATTEMPTS = 5;
 export const MAX_FINDINGS = 20;

package/plugins/sp/scripts/script-contract-check.ts

@@ -178,6 +178,47 @@ export function scanShippedSurfaces(pluginDir: string): Array<{ file: string; li
     return matches;
 }
 
+// Bare-specifier value imports in bundled surfaces break `superskill install`, which
+// bundles hooks/scripts on targets with no node_modules (task 0669; releases
+// 0.3.81–0.3.88 failed with "Bundle failed" when scripts imported @gobing-ai/ts-utils).
+// Type-only imports are erased before bundling, so they stay legal. Line-based
+// statement walk (import/export statements are column 0 under biome) — lookahead
+// regexes misbehave in Bun 1.3.x (JSC) when grouped with lazy quantifiers.
+function findGobingAiValueImports(dir: string): { file: string; line: number }[] {
+    const hits: { file: string; line: number }[] = [];
+    let entries: string[];
+    try {
+        entries = readdirSync(dir);
+    } catch {
+        return hits;
+    }
+    for (const entry of entries) {
+        const full = join(dir, entry);
+        let st: ReturnType<typeof statSync>;
+        try {
+            st = statSync(full);
+        } catch {
+            continue;
+        }
+        if (st.isDirectory()) {
+            hits.push(...findGobingAiValueImports(full));
+        } else if (entry.endsWith('.ts')) {
+            const lines = readFileSync(full, 'utf8').split('\n');
+            let stmtStart = 0;
+            for (let i = 0; i < lines.length; i++) {
+                if (/^\s*(?:import|export)\b/.test(lines[i])) stmtStart = i;
+                if (/(?:from\s*|import\s*|import\s*\(\s*)['"]@gobing-ai\//.test(lines[i])) {
+                    const opener = lines.slice(stmtStart, i + 1).join(' ');
+                    if (!/^\s*(?:import|export)\s+type\b/.test(opener)) {
+                        hits.push({ file: full, line: i + 1 });
+                    }
+                }
+            }
+        }
+    }
+    return hits;
+}
+
 export function validateContract(manifest: ScriptManifest, scriptsDir: string, pluginDir: string): Violation[] {
     const violations: Violation[] = [];
     const { tsFiles, mjsFiles } = listDiskScripts(scriptsDir);
@@ -280,6 +321,23 @@ export function validateContract(manifest: ScriptManifest, scriptsDir: string, p
         });
     }
 
+    // Rule 5: bundled surfaces (scripts, hooks, lib) must not value-import @gobing-ai/*.
+    // superskill install bundles them where no node_modules exists; resolution then
+    // depends on the host superskill's private dep tree (0.3.28+ happens to carry
+    // ts-utils — an accident we do not depend on). Vendor into plugins/sp/lib/ instead.
+    for (const dir of [scriptsDir, join(pluginDir, 'hooks'), join(pluginDir, 'lib')]) {
+        for (const hit of findGobingAiValueImports(dir)) {
+            violations.push({
+                kind: 'gobing_ai_import',
+                target: `${hit.file}:${hit.line}`,
+                message:
+                    `bundled surface ${hit.file}:${hit.line} value-imports @gobing-ai/* — ` +
+                    'superskill install bundles it with no node_modules ("Bundle failed", task 0669). ' +
+                    'Vendor into plugins/sp/lib/ or use a relative import; `import type` is exempt.',
+            });
+        }
+    }
+
     return violations;
 }
 

package/plugins/sp/scripts/task-evidence-precheck.ts

@@ -37,7 +37,7 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 /** Exact task-content declaration that activates the live-evidence gate (0726 R2). */
 const DECLARATION_PREFIX = 'evidence-channel:';

package/plugins/sp/scripts/task-size-precheck.ts

@@ -26,7 +26,7 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 // ─── Counting (sync with packages/app/src/services/task-size-precheck.ts) ────
 

package/plugins/sp/scripts/verify-answer-lint.ts

@@ -32,7 +32,7 @@
 import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 // ─── CLI (same spur-bin chain as task-evidence-precheck.ts) ─────────────────
 

package/plugins/sp/scripts/workflow-step-profile.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from "child_process";
 import { existsSync } from "fs";
 import { fileURLToPath } from "url";
 
-// ../ts-libs/packages/utils/dist/env.js
+// plugins/sp/lib/env.ts
 function getEnvVar(name, fallback) {
   const raw = process.env[name];
   return raw === undefined ? fallback : raw;

package/plugins/sp/scripts/workflow-step-profile.ts

@@ -25,7 +25,7 @@
 import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
-import { getEnvVar } from '@gobing-ai/ts-utils';
+import { getEnvVar } from '../lib/env';
 
 // ── Input shapes (a subset of the live `spur workflow trace --json` payload) ─────────────
 

package/plugins/sp/scripts/wrapup-steps.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from "child_process";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
 
-// ../ts-libs/packages/utils/dist/env.js
+// plugins/sp/lib/env.ts
 function getEnvVars() {
   return process.env;
 }

package/plugins/sp/scripts/wrapup-steps.ts

@@ -31,7 +31,7 @@
 import { spawnSync } from 'node:child_process';
 import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { getEnvVars } from '@gobing-ai/ts-utils';
+import { getEnvVars } from '../lib/env';
 
 export interface WrapupStepsEnv {
     __runId?: string;

package/plugins/sp/skills/spur-cli/references/workflows.md

@@ -108,7 +108,7 @@ The skill's logic divides by **whether the LLM adds value**:
 | --------- | --------- | ----- | ------------------ |
 | `validate` | `spur workflow validate` (CLI) | `<file> [--no-schema]` | Schema + semantic verdict |
 | `run` | `spur workflow run` (CLI) | `<file> [--run-id <id>] [--vars <json>] [--dry-run] [--async] [--no-plan] [--quiet/--silent/--verbose] [--detail <level>] [--trace-file] [--no-log] [--steer]` | Terminal state reached (sync) or run started (async); trace readable |
-| `continue` | `spur workflow continue` (CLI) | `[run-id] [--yes] [--answer <yes\|no\|cancel>]` | Resume a paused HITL run (omit id -> most recent paused); `--answer` injects a gate answer before guard re-evaluation |
+| `continue` | `spur workflow continue` (CLI) | `[run-id] [--yes] [--answer <yes\|no\|cancel>] [--async] [--no-log]` | Resume a paused or interrupted run (omit id -> most recent resumable); `--answer` injects a gate answer before guard re-evaluation and is required headless (0901 R3); `--async` detaches the resume (0901 R4) |
 | `cancel` | `spur workflow cancel` (CLI) | `<run-id>` | Single non-terminal run marked failed (SIGTERM async worker when live) |
 | `clean` | `spur workflow clean` (CLI) | `[--older-than <min>] [--force] [--logs] [--dry-run]` | Bulk-finalize stale `running`/`pending` runs as failed **and** reclaim retained run logs older than `workflow.logRetentionDays` (30d default) |
 | `list` | `spur workflow list` (CLI) | — | Available workflow **YAML definition files** (not run records) |
@@ -258,7 +258,7 @@ the operator accepts it, and never hot-edit a running workflow's shell in place.
 spur workflow validate <file> [--no-schema] [--json]
 spur workflow show      <file> [--format <mermaid|todo>] [--json]
 spur workflow run      <file> [--run-id <id>] [--vars <json>] [--dry-run] [--async] [--no-plan] [--quiet/--silent/--verbose] [--detail <level>] [--trace-file] [--no-log] [--steer] [--json]
-spur workflow continue [run-id] [--yes] [--answer <yes|no|cancel>] [--json]
+spur workflow continue [run-id] [--yes] [--answer <yes|no|cancel>] [--async] [--no-log] [--json]
 spur workflow cancel   <run-id> [--json]
 spur workflow clean    [--older-than <minutes>] [--force] [--logs] [--dry-run] [--json]
 spur workflow list     [--json]
@@ -318,7 +318,12 @@ HITL pause/resume: a run that hits a HITL action pauses; resume with `spur workf
 (`--yes` skips confirmation). A headless `hitl.confirm` persists a default `no` before pausing -
 use `--answer yes|no|cancel` to inject the operator's gate answer before guard re-evaluation (0433).
 `--answer` is distinct from `--yes`: `--yes` skips the CLI resume prompt, `--answer` sets the HITL
-gate answer. Cancel one live/paused run with `cancel <run-id>`; bulk-finalize orphans stuck in
+gate answer. 0901: resumes accept interrupted runs too (rerun-enter re-executes the interrupted
+node and needs `resumeRerun: true` on the target state); a headless (`--json`/non-TTY) continue
+without `--answer` is refused (exit 2); `--async` detaches the resume and reports started/failed
+after the worker claims the run; resumed runs write the consolidated run log and pass shell
+streams through the secret redactor + 64 KiB tail unless `--no-log`. Cancel one live/paused run
+with `cancel <run-id>`; bulk-finalize orphans stuck in
 `running`/`pending` with `clean` (`--older-than` default 30 minutes, or `--force`).
 
 **Schema resolution parity (0431):** `validate` and `run` both load the workflow through