@gobing-ai/spur 0.3.94 → 0.3.96

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.94",
+            "version": "0.3.96",
             "source": "./plugins/sp"
         }
     ]

package/README.md

@@ -59,6 +59,21 @@ If `~/.local/bin` isn't already on your `PATH`, add it (e.g. `export PATH="$HOME
 in your shell profile). Supported targets: `darwin-arm64`, `darwin-x64`, `linux-arm64`, `linux-x64`.
 Windows: use the Bun path under WSL.
 
+**Verification.** The installer downloads to a temp file, checks it against the release's
+`SHA256SUMS`, and only then atomically replaces `spur`. A failed download, a checksum mismatch, or a
+missing `SHA256SUMS` leaves an existing install untouched and exits non-zero. `SPUR_RELEASE_URL`
+overrides the download base URL (a mirror, or a `file://` directory in tests).
+
+The checksum is a **code-execution** boundary, not just an integrity check: having verified the
+download, the installer *runs* it (`spur init`), so a release whose `SHA256SUMS` cannot be verified
+is a release you cannot safely install. `SPUR_SKIP_VERIFY=1` is the single explicit bypass and
+prints a warning — keep it for local or air-gapped installs, and pipe the script into `sh` only from
+a source you trust.
+
+**Releasing standalone binaries.** Run `bun run build:binaries` in `apps/cli`, then upload **all**
+of `dist/cli/spur-*` **and** `dist/cli/SHA256SUMS` to the GitHub Release for the tag. A release
+without `SHA256SUMS` makes the installer fail by default.
+
 ### Package layout (what ships)
 
 The published tarball is a self-contained Bun bundle plus static assets:
@@ -98,6 +113,33 @@ spur status
 
 Every command supports `--json` for machine-readable output.
 
+### Extending the Spur Board
+
+A project can add its own Board modules — a compiled React tool or an embedded URL app — without
+editing this package. An installed Board reads them from a fresh project's `.spur/config.yaml`:
+
+```yaml
+bootstrap:
+  modules:
+    - id: team-board
+      name: Team board
+      icon: "🧭"
+      type: react
+      directory: board/team-board/dist
+      entry: index.js
+      styles: [index.css]
+    - id: docs
+      name: Documentation
+      icon: "📚"
+      type: iframe
+      url: https://docs.example.test/
+```
+
+`spur init` seeds `modules: []` (built-ins only); change selection with a config edit, then restart
+`spur serve` and reload. The full authoring contract — the declaration union, the
+`@gobing-ai/spur/board` type export, the Vite library setup and the frame/trust limits — is in the
+[downstream Board modules design](https://github.com/gobing-ai/spur/blob/main/docs/design/downstream-board-modules.md).
+
 ## Documentation
 
 Full docs, architecture, and the complete command surface live in the

package/board/index.d.ts

@@ -0,0 +1,38 @@
+// Generated by scripts/commands/emit-board-types.ts from
+// apps/web/src/modules/contribution.ts — edit the authoring source, then regenerate.
+import type { ComponentType } from 'react';
+/**
+ * Public authoring contract for a native (compiled React) Board module contribution
+ * (A8 / task 0988 R1).
+ *
+ * This file is the ONE authoring source for the declaration-only `@gobing-ai/spur/board`
+ * package export: `scripts/commands/emit-board-types.ts` emits `apps/cli/board/index.d.ts`
+ * from it, so the published ABI cannot drift from the Board's own types. Keep it
+ * type-only — no React *value* import may reach the CLI or plugin artifacts (the CLI
+ * ships no React; the contributor supplies compatible React types through its own
+ * devDependencies).
+ *
+ * Module metadata (id/name/icon/route) is deliberately absent: it is project
+ * configuration (one selection authority), while this shape carries only what the
+ * renderer needs to mount a contribution.
+ */
+export interface BoardModuleContribution {
+    /** Contribution protocol version this Board accepts. */
+    readonly apiVersion: 1;
+    /**
+     * Workspace component. Rendered inside the Board's React tree with the Board's own
+     * React instance — it must not call `createRoot`, and no private Board context is
+     * exported to it.
+     */
+    readonly component: ComponentType;
+    /** Optional companion the Board's right panel renders while this module is active. */
+    readonly rightPanelComponent?: ComponentType;
+}
+/**
+ * The named export a native Board module entry must publish.
+ *
+ * Declared rather than implemented: `@gobing-ai/spur/board` is a declaration-only export,
+ * not a runtime SDK (consumers import its types; their compiled ESM entry exports this
+ * name for the renderer).
+ */
+export declare const webModule: BoardModuleContribution;

package/config/plugin-scripts.json

@@ -26,11 +26,6 @@
             "contract": "standard",
             "twin": "dogfood-testing/validate-report.mjs"
         },
-        {
-            "rel": "feature-sync-bounded.ts",
-            "contract": "standard",
-            "twin": "feature-sync-bounded.mjs"
-        },
         {
             "rel": "idea-handoff.ts",
             "contract": "standard",
@@ -61,24 +56,11 @@
             "contract": "standard",
             "twin": "feature-verification-steps.mjs"
         },
-        {
-            "rel": "idea-coverage-check.ts",
-            "contract": "repo-only"
-        },
-        {
-            "rel": "inline-pipeline-parity-check.ts",
-            "contract": "repo-only"
-        },
         {
             "rel": "pr-reviewing.ts",
             "contract": "standard",
             "twin": "pr-reviewing.mjs"
         },
-        {
-            "rel": "record-feature-sync.ts",
-            "contract": "standard",
-            "twin": "record-feature-sync.mjs"
-        },
         {
             "rel": "quality-gate.ts",
             "contract": "standard",
@@ -90,46 +72,15 @@
             "twin": "residual-scan.mjs"
         },
         {
-            "rel": "script-contract-check.ts",
-            "contract": "repo-only"
-        },
-        {
-            "rel": "stage-registry-adapter.ts",
-            "contract": "repo-only"
-        },
-        {
-            "rel": "surface-drift-inventory.ts",
-            "contract": "repo-only"
+            "rel": "script-root.ts",
+            "contract": "standard",
+            "twin": "script-root.mjs"
         },
         {
             "rel": "task-diffstat.ts",
             "contract": "standard",
             "twin": "task-diffstat.mjs"
         },
-        {
-            "rel": "task-evidence-precheck.ts",
-            "contract": "repo-only"
-        },
-        {
-            "rel": "task-size-precheck.ts",
-            "contract": "repo-only"
-        },
-        {
-            "rel": "verify-answer-lint.ts",
-            "contract": "repo-only"
-        },
-        {
-            "rel": "transition-shim-check.ts",
-            "contract": "repo-only"
-        },
-        {
-            "rel": "validate-commands.ts",
-            "contract": "repo-only"
-        },
-        {
-            "rel": "validate-flag-contracts.ts",
-            "contract": "repo-only"
-        },
         {
             "rel": "workflow-step-profile.ts",
             "contract": "standard",

package/config/rules/boundary/sp-script-placement.yaml

@@ -0,0 +1,19 @@
+$schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
+# [boundary] ADR-130 script placement contract (task 1000). Runs the fast
+# --placement-only mode of the relocated script-contract-check on every
+# recommended-pre-check; SKIPs outside the Spur source repo (same pattern as
+# strict/rule-files-structural.yaml SKIP on missing yq). The full twin check
+# stays in spur-check-feature.
+rules:
+  - id: sp-script-placement
+    description: "Plugins/sp scripts must honor the ADR-130 placement contract (glue budget, no db imports, no corpus parsing, no noun clash); baseline config/script-placement-baseline.json can only shrink."
+    severity: error
+    evaluator:
+      type: exit-code
+      config:
+        command: sh
+        args:
+          - -c
+          - >-
+            [ -f scripts/commands/script-contract-check.ts ] || { echo "SKIP: not the Spur source repo"; exit 0; };
+            bun scripts/commands/script-contract-check.ts --placement-only

package/config/rules/strict/runtime-boundaries.yaml

@@ -32,6 +32,9 @@ rules:
             - "**/tests/**"
             - "**/*.test.ts"
 
+            # Low-level system primitives:
+            - "packages/app/src/services/quality-gate.ts" # gate runs `sh -c` with stdout+stderr merged onto ONE fd; ProcessExecutor captures streams separately and cannot reproduce the stream-order contract (task 1006 R1; mirrors the history-anatomy bundling exemptions)
+
   - id: no-direct-fs-io
     description: "Prefer ts-runtime's FileSystem seam for fs IO."
     severity: warning
@@ -60,9 +63,11 @@ rules:
             - "packages/app/src/services/slash-commands-service.ts" # synchronous ~/.config/spur/slash_commands.json persistence (mirrors project-registry.ts)
             - "packages/app/src/services/agent-usage-producer.ts" # atomic agent-usage snapshot write (tmp + rename, mirrors project-registry.ts; task 0892 R1)
             - "packages/app/src/services/history-service.ts" # versioned analyze artifact + bounded-errors sidecar + latest.json symlink pointer (task 0474); ts-runtime FileSystem seam has no symlink, so the pointer uses node:fs directly (mirrors project-registry.ts persistence exemption)
+            - "packages/app/src/services/history-anatomy.ts" # deterministic history-anatomy cache core (task 1005 R2): fsync'd tmp+rename atomic publish, readdir digest scans and sync report reads must stay byte-stable; bundled standalone for the bare-node plugin twin (mirrors agent-usage-producer.ts / history-service.ts exemptions)
             - "packages/app/src/observability/workflow-run-log-sink.ts" # sync FD append for mid-run tail-able all-in-one run log (task 0426 / feature D2); append() is sync from the observability bus
             - "apps/cli/src/commands/workflow.ts" # FD byte-window tail of the mid-run run log for `workflow trace --follow` streaming (task 0428 / feature D2); readSync at offset over the observability sink's FDs
             - "apps/web/src/modules/discover.ts" # Vite/Astro module scanner fallback under bun test
+            - "packages/app/src/services/quality-gate.ts" # gate artifacts (log/findings/receipt) written directly; merged-fd gate log and fsync-free atomic writes must stay byte-stable; bundled standalone for the bare-node plugin twin (task 1006 R1; mirrors history-anatomy.ts)
 
             # Synchronous bootstrap & path resolution:
             - "packages/config/src/bundled-config.ts" # sync bundledConfigRoot() directory walk

package/config/rules/structure/test-location.yaml

@@ -36,6 +36,8 @@ rules:
       - "apps/**/src/**/*.ts"
 
     exclude:
+      ## transient CLI test-fixture projects (apps/cli/tests/.tmp-*), same pattern as .gitignore
+      - "**/.tmp-*/**"
       - "**/index.ts"
       - "**/*.d.ts"
       - "**/types.ts"

package/config/rules/typescript/no-syscall-emulation-in-boundary-mock.yaml

@@ -12,7 +12,7 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # replaced the very portability the tests were supposed to verify.
 #
 # SCOPE / discriminator: mocking the subprocess boundary to control *subprocess
-# responses* (e.g. feature-sync-bounded.test.ts intercepting `show`/`list`/`sync`
+# responses* (e.g. a boundary test intercepting `show`/`list`/`sync`
 # commands) is legitimate and NOT flagged — the boundary mock returns canned
 # responses, it does not re-implement the syscall the code under test calls. The
 # rule fires only when the mock handler itself references `stat`/`%m`/`birthtime`

package/config/rules/typescript/output-boundaries.yaml

@@ -2,8 +2,9 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # Output boundary rules — terminal writes go through the output seam
 # (apps/cli/src/output.ts → ts-utils echo/echoError), never raw console/stdout.
 # Absorbed from ts-libs/.spur/rules/typescript/no-raw-output.yaml, re-scoped to
-# the app-monorepo layout. Spur's only sanctioned sink is the ts-utils helper,
-# so no local exclusions are needed.
+# the app-monorepo layout. Spur's only sanctioned sink is the ts-utils helper;
+# narrow per-rule excludes exist only for moved driver code whose byte-stable
+# stdout contract must survive lib bundling under bare node (task 1006).
 include:
   - "apps/**/src/**/*.ts"
   - "packages/**/src/**/*.ts"
@@ -16,6 +17,11 @@ rules:
       type: rg
       config:
         pattern: "console\\.(log|error|warn|info|debug|dir|time|trace)"
+    # Task 1006 R3: the inline-run driver's fail-closed stderr lines moved here from the
+    # plugin script (byte-stable driver contract, emitted through the bundled lib under
+    # bare node); the output seam is a CLI-layer dependency the app service cannot take.
+    exclude:
+      - "packages/app/src/services/inline-run-setup.ts"
 
   - id: no-raw-stdout-stderr
     description: "Use the output seam (ts-utils echo/echoError) instead of process.stdout/stderr.write directly."
@@ -24,3 +30,10 @@ rules:
       type: rg
       config:
         pattern: "process\\.(stdout|stderr)\\.write"
+    # Tasks 1006 R1/R3: gate receipts (`check-receipt/v1`, one JSON line — the runner's parsed
+    # stdout contract) and the inline driver's stdout lines moved here from the plugin scripts.
+    # Both must stay byte-stable through the bundled libs under bare node; the seam would
+    # rewrite framing the CLI/tests parse. Mirrors the history-anatomy bundling exemptions.
+    exclude:
+      - "packages/app/src/services/quality-gate.ts"
+      - "packages/app/src/services/inline-run-setup.ts"

package/config/script-placement-baseline.json

@@ -0,0 +1,51 @@
+{
+    "schemaVersion": 1,
+    "description": "ADR-130 placement baseline (task 1000, seeded from plan \u00a72 inventory). Entries suppress sp-script-placement findings; kinds[] rows are migration-ledger entries for plan \u00a72 rows with no current findings. Baseline can only shrink: a listed kind the file no longer produces is a stale-baseline finding. Tasks 1001-1007 delete their entries in the same commit as the move.",
+    "entries": {
+        "plugins/sp/scripts/pr-reviewing.ts": {
+            "kinds": ["budget"],
+            "reason": "Keep, sp-owned git/gh loop; cited exemption (plan \u00a72)"
+        },
+        "plugins/sp/scripts/wrapup-steps.ts": {
+            "kinds": ["budget"],
+            "reason": "Keep (budget exemption), W2 (plan \u00a72)",
+            "exempt": true
+        },
+        "plugins/sp/scripts/batch-preflight.ts": {
+            "kinds": ["budget"],
+            "reason": "Keep (budget exemption; reviewed W4) (plan \u00a72)",
+            "exempt": true
+        },
+        "plugins/sp/scripts/feature-verification-steps.ts": {
+            "kinds": ["budget"],
+            "reason": "Keep (ADR-119 receipt writer; budget exemption) (plan \u00a72)",
+            "exempt": true
+        },
+        "plugins/sp/scripts/wrapup-drift-probe.ts": {
+            "kinds": ["budget", "corpus-parse"],
+            "reason": "Keep (glue over capture file; budget exemption) (plan \u00a72)",
+            "exempt": true
+        },
+        "plugins/sp/scripts/daily-summary/daily-summary.ts": {
+            "kinds": ["budget", "db-import"],
+            "reason": "Keep (daily-summary/, plan \u00a72); read-only history-health query via dynamic bun:sqlite import (task 1018)"
+        },
+        "plugins/sp/scripts/dogfood-testing/detect-pipeline-driving.ts": {
+            "kinds": ["budget"],
+            "reason": "Keep (dogfood-testing/, plan \u00a72)"
+        },
+        "plugins/sp/scripts/dogfood-testing/validate-report.ts": {
+            "kinds": ["budget"],
+            "reason": "Keep (dogfood-testing/, plan \u00a72)"
+        },
+        "plugins/sp/hooks/context-post-tool.ts": {
+            "kinds": ["budget"],
+            "reason": "Keep: ADR-129 core (budget exemption) (plan \u00a72)",
+            "exempt": true
+        },
+        "plugins/sp/hooks/pi/guard-extension.ts": {
+            "kinds": ["budget"],
+            "reason": "Keep (ADR-129 normalizer) (plan \u00a72)"
+        }
+    }
+}

package/config/workflows/feature-verification.yaml

@@ -50,13 +50,16 @@ states:
       digest, run identity) and the coarse status file, always exit 0 so the
       transition guard routes missing/corrupt/FAIL to `failed`.
     onEnter:
+      # 0960 R2: run-start script-resolution identity — record which tree this run
+      # resolved (source-repo vs installed) before the verification step runs. Never aborts.
       - kind: shell
         options:
           command: >-
-            bun plugins/sp/scripts/feature-verification-steps.ts verify
-            --feature-id "$featureId"
-            --run-id "$__runId"
-            --spur-bin "$spurBin"
+            S=plugins/sp/scripts/script-root.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp script-root.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" --run-id "$__runId" --spur-bin "$spurBin" || echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 0
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run; eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/feature-verification-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/feature-verification-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; [ -f "$S" ] && "$RUNNER" "$S" verify --feature-id "$featureId" --run-id "$__runId" --spur-bin "$spurBin" || printf 'FAIL feature-verification failed closed — script not found — run superskill install sp --marketplace gobing-ai/spur\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
 
   - id: done
     description: Terminal — repo-wide checks passed and the receipt is bound.

package/config/workflows/history-anatomy.yaml

@@ -102,6 +102,14 @@ states:
           # exempt from the catalog record-name sweep (see run-record-catalog.test.ts).
 
 
+      # 1007 R8: run-start script-resolution identity (same command as feature-verification
+      # verify's first action), placed AFTER the id allocation above — the snippet reads
+      # .spur/run/$__runId-script-root.json, so it needs the allocated id. Later
+      # plugin-script actions resolve through it (1007 R4 snippet). Never aborts.
+      - kind: shell
+        options:
+          command: >-
+            S=plugins/sp/scripts/script-root.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp script-root.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" --run-id "$__runId" --spur-bin "$spurBin" || echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 0
   - id: resolve-paths
     description: >
       Resolve the helper, the skill/contract logic paths, and the publication target once, into a
@@ -113,8 +121,8 @@ states:
           # Path arithmetic lives in the helper (ADR-069 R1); the shell only locates it. Avoid
           # `${...}` here — that syntax collides with the engine's own template interpolation.
           command: >-
-            h=$(superskill script path sp history-anatomy-cache.mjs);
-            node "$h" paths --helper "$h" --report-dir "$reportDir" --date "$date"
+            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
+            "$RUNNER" "$S" paths --helper "$S" --report-dir "$reportDir" --date "$date"
             --output "$output" --mode "$mode" --since "$since" --until "$until"
             --focus "$focus" --recompute "$recompute" --run-id "$__runId"
             --out .spur/run/$__runId-paths.txt
@@ -147,12 +155,13 @@ states:
       - kind: shell
         options:
           command: >-
+            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
             . .spur/run/$__runId-paths.txt;
-            node "$HA_HELPER" probe --artifact .spur/run/$__runId-history-anatomy-current.json
+            "$RUNNER" "$S" probe --artifact .spur/run/$__runId-history-anatomy-current.json
             --baseline .spur/run/$__runId-history-anatomy-baseline.json --target "$HA_TARGET"
             --mode "$mode" --date "$HA_DATE" --recompute "$recompute" --executor "$agent"
             --skill-dir "$HA_SKILL" --contract "$HA_SKILL/references/report-contract.md"
-            --workflow "$workflowFile" --helper "$HA_HELPER" --contract-version "$contractVersion" --run-id "$__runId"
+            --workflow "$workflowFile" --helper "$S" --contract-version "$contractVersion" --run-id "$__runId"
             --out .spur/run/$__runId-provenance.json
             > .spur/run/$__runId-cache-disposition.txt
 
@@ -189,7 +198,7 @@ states:
       - kind: shell
         options:
           command: >-
-            node "$(superskill script path sp history-anatomy-cache.mjs)" assert-clean --baseline .spur/run/$__runId-baseline-enrich.txt --expect .spur/run/$__runId-candidate.md
+            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" assert-clean --baseline .spur/run/$__runId-baseline-enrich.txt --expect .spur/run/$__runId-candidate.md
 
   - id: structure-gate
     description: >
@@ -200,7 +209,7 @@ states:
       - kind: shell
         options:
           command: >-
-            node "$(superskill script path sp history-anatomy-cache.mjs)" check \
+            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" check \
               .spur/run/$__runId-candidate.md > .spur/run/$__runId-structure-gate.txt 2>&1 || true
 
   - id: validate
@@ -244,7 +253,7 @@ states:
       - kind: shell
         options:
           command: >-
-            node "$(superskill script path sp history-anatomy-cache.mjs)" assert-clean --baseline .spur/run/$__runId-baseline-validate.txt --expect .spur/run/$__runId-validation.txt
+            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" assert-clean --baseline .spur/run/$__runId-baseline-validate.txt --expect .spur/run/$__runId-validation.txt
 
   - id: correct
     description: >
@@ -281,7 +290,7 @@ states:
       - kind: shell
         options:
           command: >-
-            node "$(superskill script path sp history-anatomy-cache.mjs)" assert-clean --baseline .spur/run/$__runId-baseline-correct.txt --expect .spur/run/$__runId-candidate.md
+            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" assert-clean --baseline .spur/run/$__runId-baseline-correct.txt --expect .spur/run/$__runId-candidate.md
 
   - id: refresh-provenance
     description: >
@@ -293,8 +302,9 @@ states:
       - kind: shell
         options:
           command: >-
+            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
             . .spur/run/$__runId-paths.txt;
-            node "$HA_HELPER" refresh --report "$HA_TARGET"
+            "$RUNNER" "$S" refresh --report "$HA_TARGET"
             --out .spur/run/$__runId-publishable.md --disposition hit
 
   - id: stamp
@@ -307,8 +317,9 @@ states:
       - kind: shell
         options:
           command: >-
+            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
             . .spur/run/$__runId-paths.txt;
-            node "$HA_HELPER" stamp --candidate .spur/run/$__runId-candidate.md
+            "$RUNNER" "$S" stamp --candidate .spur/run/$__runId-candidate.md
             --provenance .spur/run/$__runId-provenance.json
             --out .spur/run/$__runId-publishable.md
 
@@ -321,9 +332,10 @@ states:
       - kind: shell
         options:
           command: >-
+            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
             . .spur/run/$__runId-paths.txt;
             mkdir -p "$(dirname "$HA_TARGET")";
-            node "$HA_HELPER" publish .spur/run/$__runId-publishable.md "$HA_TARGET"
+            "$RUNNER" "$S" publish .spur/run/$__runId-publishable.md "$HA_TARGET"
 
   - id: published
     description: Terminal — report published atomically after a passing validation.