@gobing-ai/spur 0.3.89 → 0.3.90

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.89",
+    "version": "0.3.90",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/scripts/script-contract-check.ts

@@ -178,6 +178,47 @@ export function scanShippedSurfaces(pluginDir: string): Array<{ file: string; li
     return matches;
 }
 
+// Bare-specifier value imports in bundled surfaces break `superskill install`, which
+// bundles hooks/scripts on targets with no node_modules (task 0669; releases
+// 0.3.81–0.3.88 failed with "Bundle failed" when scripts imported @gobing-ai/ts-utils).
+// Type-only imports are erased before bundling, so they stay legal. Line-based
+// statement walk (import/export statements are column 0 under biome) — lookahead
+// regexes misbehave in Bun 1.3.x (JSC) when grouped with lazy quantifiers.
+function findGobingAiValueImports(dir: string): { file: string; line: number }[] {
+    const hits: { file: string; line: number }[] = [];
+    let entries: string[];
+    try {
+        entries = readdirSync(dir);
+    } catch {
+        return hits;
+    }
+    for (const entry of entries) {
+        const full = join(dir, entry);
+        let st: ReturnType<typeof statSync>;
+        try {
+            st = statSync(full);
+        } catch {
+            continue;
+        }
+        if (st.isDirectory()) {
+            hits.push(...findGobingAiValueImports(full));
+        } else if (entry.endsWith('.ts')) {
+            const lines = readFileSync(full, 'utf8').split('\n');
+            let stmtStart = 0;
+            for (let i = 0; i < lines.length; i++) {
+                if (/^\s*(?:import|export)\b/.test(lines[i])) stmtStart = i;
+                if (/(?:from\s*|import\s*|import\s*\(\s*)['"]@gobing-ai\//.test(lines[i])) {
+                    const opener = lines.slice(stmtStart, i + 1).join(' ');
+                    if (!/^\s*(?:import|export)\s+type\b/.test(opener)) {
+                        hits.push({ file: full, line: i + 1 });
+                    }
+                }
+            }
+        }
+    }
+    return hits;
+}
+
 export function validateContract(manifest: ScriptManifest, scriptsDir: string, pluginDir: string): Violation[] {
     const violations: Violation[] = [];
     const { tsFiles, mjsFiles } = listDiskScripts(scriptsDir);
@@ -280,6 +321,23 @@ export function validateContract(manifest: ScriptManifest, scriptsDir: string, p
         });
     }
 
+    // Rule 5: bundled surfaces (scripts, hooks, lib) must not value-import @gobing-ai/*.
+    // superskill install bundles them where no node_modules exists; resolution then
+    // depends on the host superskill's private dep tree (0.3.28+ happens to carry
+    // ts-utils — an accident we do not depend on). Vendor into plugins/sp/lib/ instead.
+    for (const dir of [scriptsDir, join(pluginDir, 'hooks'), join(pluginDir, 'lib')]) {
+        for (const hit of findGobingAiValueImports(dir)) {
+            violations.push({
+                kind: 'gobing_ai_import',
+                target: `${hit.file}:${hit.line}`,
+                message:
+                    `bundled surface ${hit.file}:${hit.line} value-imports @gobing-ai/* — ` +
+                    'superskill install bundles it with no node_modules ("Bundle failed", task 0669). ' +
+                    'Vendor into plugins/sp/lib/ or use a relative import; `import type` is exempt.',
+            });
+        }
+    }
+
     return violations;
 }
 

package/plugins/sp/skills/spur-cli/references/workflows.md

@@ -108,7 +108,7 @@ The skill's logic divides by **whether the LLM adds value**:
 | --------- | --------- | ----- | ------------------ |
 | `validate` | `spur workflow validate` (CLI) | `<file> [--no-schema]` | Schema + semantic verdict |
 | `run` | `spur workflow run` (CLI) | `<file> [--run-id <id>] [--vars <json>] [--dry-run] [--async] [--no-plan] [--quiet/--silent/--verbose] [--detail <level>] [--trace-file] [--no-log] [--steer]` | Terminal state reached (sync) or run started (async); trace readable |
-| `continue` | `spur workflow continue` (CLI) | `[run-id] [--yes] [--answer <yes\|no\|cancel>]` | Resume a paused HITL run (omit id -> most recent paused); `--answer` injects a gate answer before guard re-evaluation |
+| `continue` | `spur workflow continue` (CLI) | `[run-id] [--yes] [--answer <yes\|no\|cancel>] [--async] [--no-log]` | Resume a paused or interrupted run (omit id -> most recent resumable); `--answer` injects a gate answer before guard re-evaluation and is required headless (0901 R3); `--async` detaches the resume (0901 R4) |
 | `cancel` | `spur workflow cancel` (CLI) | `<run-id>` | Single non-terminal run marked failed (SIGTERM async worker when live) |
 | `clean` | `spur workflow clean` (CLI) | `[--older-than <min>] [--force] [--logs] [--dry-run]` | Bulk-finalize stale `running`/`pending` runs as failed **and** reclaim retained run logs older than `workflow.logRetentionDays` (30d default) |
 | `list` | `spur workflow list` (CLI) | — | Available workflow **YAML definition files** (not run records) |
@@ -258,7 +258,7 @@ the operator accepts it, and never hot-edit a running workflow's shell in place.
 spur workflow validate <file> [--no-schema] [--json]
 spur workflow show      <file> [--format <mermaid|todo>] [--json]
 spur workflow run      <file> [--run-id <id>] [--vars <json>] [--dry-run] [--async] [--no-plan] [--quiet/--silent/--verbose] [--detail <level>] [--trace-file] [--no-log] [--steer] [--json]
-spur workflow continue [run-id] [--yes] [--answer <yes|no|cancel>] [--json]
+spur workflow continue [run-id] [--yes] [--answer <yes|no|cancel>] [--async] [--no-log] [--json]
 spur workflow cancel   <run-id> [--json]
 spur workflow clean    [--older-than <minutes>] [--force] [--logs] [--dry-run] [--json]
 spur workflow list     [--json]
@@ -318,7 +318,12 @@ HITL pause/resume: a run that hits a HITL action pauses; resume with `spur workf
 (`--yes` skips confirmation). A headless `hitl.confirm` persists a default `no` before pausing -
 use `--answer yes|no|cancel` to inject the operator's gate answer before guard re-evaluation (0433).
 `--answer` is distinct from `--yes`: `--yes` skips the CLI resume prompt, `--answer` sets the HITL
-gate answer. Cancel one live/paused run with `cancel <run-id>`; bulk-finalize orphans stuck in
+gate answer. 0901: resumes accept interrupted runs too (rerun-enter re-executes the interrupted
+node and needs `resumeRerun: true` on the target state); a headless (`--json`/non-TTY) continue
+without `--answer` is refused (exit 2); `--async` detaches the resume and reports started/failed
+after the worker claims the run; resumed runs write the consolidated run log and pass shell
+streams through the secret redactor + 64 KiB tail unless `--no-log`. Cancel one live/paused run
+with `cancel <run-id>`; bulk-finalize orphans stuck in
 `running`/`pending` with `clean` (`--older-than` default 30 minutes, or `--force`).
 
 **Schema resolution parity (0431):** `validate` and `run` both load the workflow through