@gobing-ai/spur 0.4.1 → 0.4.3

package/plugins/sp/scripts/quality-gate.mjs

@@ -21,16 +21,14 @@ import {
   mkdirSync,
   mkdtempSync,
   openSync,
-  readdirSync,
   readFileSync,
-  rmdirSync,
   rmSync,
   statSync,
   unlinkSync,
   writeFileSync
 } from "node:fs";
-import { homedir, tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
 import { createHash } from "node:crypto";
 var __defProp = Object.defineProperty;
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
@@ -82,19 +80,9 @@ var init_api_response = __esm(() => {
   CLIENT_SAFE_CODES = new Set([ErrorCode.NotFound, ErrorCode.Validation, ErrorCode.Conflict]);
 });
 var init_cursor = () => {};
-function getEnvVar(name, fallback) {
-  const raw = process.env[name];
-  return raw === undefined ? fallback : raw;
-}
 function getEnvVars2() {
   return process.env;
 }
-function setEnvVar(name, value) {
-  if (value === undefined)
-    delete process.env[name];
-  else
-    process.env[name] = value;
-}
 var init_event_severity = () => {};
 var init_dist = __esm(() => {
   init_api_response();
@@ -24449,6 +24437,7 @@ function isRfc3339Timestamp(value) {
 var ALL_FINDING_CODES = [
   "L1.markdown-parse",
   "L1.schema-validation",
+  "L1.wbs-collision",
   "L2.missing-required-section",
   "L2.forbidden-section",
   "L2.disallowed-section",
@@ -24476,6 +24465,7 @@ var ALL_FINDING_CODES = [
   "L4.design-placeholder",
   "L4.feature-not-found",
   "L4.feature-terminal",
+  "L4.feature-deprecated",
   "L4.missing-feature-id",
   "L4.parent-not-found",
   "L4.dependency-not-found",
@@ -24913,7 +24903,7 @@ var POST_WATERMARK_TABLES = [
   "history_daily_stats",
   "history_board_source_daily"
 ];
-var HISTORY_IMPORT_SCHEMA_VERSION = "0.5.21";
+var HISTORY_IMPORT_SCHEMA_VERSION = "0.5.24";
 var HISTORY_IMPORT_SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS history_import_checkpoint (
     source TEXT NOT NULL,
@@ -27632,6 +27622,8 @@ var artifactsTable = defineTable("artifacts", {
   ...standardColumns
 });
 var artifacts = artifactsTable.table;
+var encoder = new TextEncoder;
+var decoder = new TextDecoder;
 init_schema();
 var phaseRunsTable = defineTable("phase_runs", {
   id: text("id").primaryKey(),
@@ -27867,6 +27859,9 @@ var INBOX_MESSAGES_REQUEST_KEY_SCHEMA_SQL = `
 ALTER TABLE inbox_messages ADD COLUMN request_key TEXT;
 CREATE UNIQUE INDEX IF NOT EXISTS idx_inbox_messages_request_key ON inbox_messages (request_key) WHERE request_key IS NOT NULL;
 `;
+var INBOX_MESSAGES_READ_AT_SCHEMA_SQL = `
+ALTER TABLE inbox_messages ADD COLUMN read_at INTEGER;
+`;
 var QUEUE_JOBS_SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS queue_jobs (
     id TEXT PRIMARY KEY,
@@ -28879,6 +28874,11 @@ var CLI_MIGRATIONS = [
   {
     id: "0052_spur_cli_decision_logs",
     sql: DECISION_LOGS_SCHEMA_SQL
+  },
+  {
+    id: "0053_spur_cli_inbox_messages_read_at",
+    sql: INBOX_MESSAGES_READ_AT_SCHEMA_SQL,
+    addColumnIfMissing: { table: "inbox_messages", column: "read_at" }
   }
 ];
 init_zod();
@@ -29824,7 +29824,15 @@ function escapeYamlValue(value) {
 }
 init_zod();
 var TASK_STATUSES = ["backlog", "todo", "wip", "testing", "blocked", "done", "cancelled"];
-var FEATURE_STATUSES = ["backlog", "active", "verifying", "blocked", "done", "cancelled"];
+var FEATURE_STATUSES = [
+  "backlog",
+  "active",
+  "verifying",
+  "blocked",
+  "done",
+  "cancelled",
+  "deprecated"
+];
 var PRIORITIES = ["P0", "P1", "P2", "P3"];
 var PROFILES = [
   "simple",
@@ -30367,159 +30375,6 @@ function runShellCommand(cmd, cwd, extraEnv) {
     rmSync(dir, { recursive: true, force: true });
   }
 }
-var GATE_LOCK_DIR_ENV = "SPUR_GATE_LOCK_DIR";
-var GATE_LOCK_POLL_MS_ENV = "SPUR_GATE_LOCK_POLL_MS";
-var GATE_LOCK_OFF_ENV = "SPUR_GATE_LOCK";
-var GATE_LOCK_TOKEN_ENV = "SPUR_GATE_LOCK_TOKEN";
-var GATE_LOCK_POLL_MS_DEFAULT = 5000;
-var GATE_LOCK_MKDIR_HOLD_MS_ENV = "SPUR_GATE_LOCK_TEST_MKDIR_HOLD_MS";
-var GATE_LOCK_LOST_RACE_SLEEP_MS = 20;
-var GATE_LOCK_LOST_RACE_LOG_AT = 250;
-function gateLockDir() {
-  const raw = getEnvVar(GATE_LOCK_DIR_ENV);
-  return raw !== undefined && raw.length > 0 ? raw : join(homedir(), ".config", "spur", "run", "full-gate.lock");
-}
-function gateLockPollMs() {
-  const raw = Number.parseInt(getEnvVar(GATE_LOCK_POLL_MS_ENV) ?? "", 10);
-  return Number.isFinite(raw) && raw > 0 ? raw : GATE_LOCK_POLL_MS_DEFAULT;
-}
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error51) {
-    return error51.code !== "ESRCH";
-  }
-}
-function readGateLockClaim(dir) {
-  let markers;
-  try {
-    markers = readdirSync(dir).sort();
-  } catch {
-    return null;
-  }
-  for (const marker of markers) {
-    try {
-      const claim = JSON.parse(readFileSync(join(dir, marker), "utf8"));
-      if (typeof claim.pid === "number")
-        return { claim, marker };
-    } catch {
-      const pid = Number.parseInt(/^(\d+)-/.exec(marker)?.[1] ?? "", 10);
-      if (pid > 0) {
-        return { claim: { pid, startedAt: Date.now(), wbs: "?", runId: "?", cwd: "?" }, marker };
-      }
-    }
-  }
-  return null;
-}
-function acquireGateLock(env2, logLine = () => {}) {
-  if ((getEnvVar(GATE_LOCK_OFF_ENV) ?? "") === "off") {
-    return { release() {}, queueWaitMs: 0, token: "" };
-  }
-  const dir = gateLockDir();
-  mkdirSync(dirname(dir), { recursive: true });
-  const pollMs = gateLockPollMs();
-  const claim = {
-    pid: process.pid,
-    startedAt: Date.now(),
-    wbs: env2.wbs,
-    runId: receiptRunId(env2),
-    cwd: process.cwd()
-  };
-  const marker = `${process.pid}-${randomUUID()}`;
-  const startedWaitingAt = Date.now();
-  let holderLogged = false;
-  let graceLogged = false;
-  let lostRaces = 0;
-  let lostRaceLogged = false;
-  const mkdirHoldMs = Number.parseInt(getEnvVar(GATE_LOCK_MKDIR_HOLD_MS_ENV) ?? "", 10);
-  for (;; ) {
-    let dirIno = null;
-    try {
-      mkdirSync(dir);
-      dirIno = statSync(dir).ino;
-      if (Number.isFinite(mkdirHoldMs) && mkdirHoldMs > 0)
-        gateSleep(mkdirHoldMs);
-      writeFileSync(join(dir, marker), JSON.stringify(claim), { flag: "wx" });
-    } catch (error51) {
-      const code = error51.code;
-      if (code === "ENOENT" || code === "EINVAL") {
-        lostRaces += 1;
-        if (lostRaces === GATE_LOCK_LOST_RACE_LOG_AT && !lostRaceLogged) {
-          lostRaceLogged = true;
-          logLine(`quality gate lock: still losing the claim race after ${lostRaces} attempts (dir ${dir})
-`);
-        }
-        gateSleep(GATE_LOCK_LOST_RACE_SLEEP_MS);
-        continue;
-      }
-      if (code !== "EEXIST") {
-        throw error51;
-      }
-    }
-    if (dirIno !== null) {
-      let currentIno = null;
-      let entries = [];
-      try {
-        currentIno = statSync(dir).ino;
-        entries = readdirSync(dir);
-      } catch {}
-      if (currentIno !== dirIno || entries.length !== 1 || entries[0] !== marker) {
-        try {
-          unlinkSync(join(dir, marker));
-        } catch {}
-        lostRaces += 1;
-        gateSleep(GATE_LOCK_LOST_RACE_SLEEP_MS);
-        continue;
-      }
-      return {
-        release() {
-          try {
-            rmSync(join(dir, marker), { force: true });
-            rmdirSync(dir);
-          } catch {}
-        },
-        queueWaitMs: Date.now() - startedWaitingAt,
-        token: marker
-      };
-    }
-    const held = readGateLockClaim(dir);
-    if (held !== null && isProcessAlive(held.claim.pid)) {
-      if (getEnvVar(GATE_LOCK_TOKEN_ENV) === held.marker) {
-        return { release() {}, queueWaitMs: Date.now() - startedWaitingAt, token: held.marker };
-      }
-      if (!holderLogged) {
-        holderLogged = true;
-        logLine(`quality gate lock: waiting for holder (wbs ${held.claim.wbs}, run ${held.claim.runId}, pid ${held.claim.pid}, cwd ${held.claim.cwd}, held ${Date.now() - held.claim.startedAt}ms)
-`);
-      }
-    } else if (held !== null) {
-      logLine(`quality gate lock: reclaimed stale claim (pid ${held.claim.pid})
-`);
-      try {
-        unlinkSync(join(dir, held.marker));
-        rmdirSync(dir);
-      } catch {}
-    } else {
-      try {
-        rmdirSync(dir);
-        graceLogged = false;
-      } catch {
-        gateSleep(pollMs);
-        try {
-          rmdirSync(dir);
-          graceLogged = false;
-        } catch {
-          if (!graceLogged) {
-            graceLogged = true;
-            logLine(`quality gate lock: dir has no readable claim and is not empty — waiting
-`);
-          }
-        }
-      }
-    }
-  }
-}
 function recomputeGateProofFingerprint(cwd, env2) {
   const taskSpecPath = env2.taskSpecPath ?? env2.taskFile;
   if (!taskSpecPath || taskSpecPath.trim() === "") {
@@ -30643,44 +30498,27 @@ function runQualityGate(mode, env2, options = {}) {
     appendFileSync(abs(logFile), probe.output);
     rmSync(abs(`${logFile}.probe`), { force: true });
   }
-  let queueWaitMs = 0;
   let gateRuntimeMs = 0;
   if (gateRc === 0) {
     const delayMs = retryDelayMs(env2);
-    const lockLine = (line) => {
+    const gateRuntimeStartMs = Date.now();
+    for (gateAttempt = 1;gateAttempt <= MAX_GATE_ATTEMPTS; gateAttempt++) {
+      const attemptLogPath = `${logFile}.attempt-${gateAttempt}`;
+      const attempt = runShellCommand(env2.qualityGateCmd ?? "", cwd);
+      writeFileSync(abs(attemptLogPath), attempt.output);
+      const locked = isTransientLock(attempt.output);
+      appendFileSync(abs(logFile), attempt.output);
+      rmSync(abs(attemptLogPath), { force: true });
+      gateRc = attempt.code;
+      if (gateRc === 0 || !locked || gateAttempt >= MAX_GATE_ATTEMPTS)
+        break;
+      const line = retryMessage(gateAttempt);
       process.stdout.write(line);
       appendFileSync(abs(logFile), line);
-    };
-    const lock = acquireGateLock(env2, lockLine);
-    queueWaitMs = lock.queueWaitMs;
-    lockLine(`quality gate lock: queueWaitMs=${queueWaitMs}
-`);
-    const gateRuntimeStartMs = Date.now();
-    const previousToken = getEnvVar(GATE_LOCK_TOKEN_ENV);
-    if (lock.token.length > 0)
-      setEnvVar(GATE_LOCK_TOKEN_ENV, lock.token);
-    try {
-      for (gateAttempt = 1;gateAttempt <= MAX_GATE_ATTEMPTS; gateAttempt++) {
-        const attemptLogPath = `${logFile}.attempt-${gateAttempt}`;
-        const attempt = runShellCommand(env2.qualityGateCmd ?? "", cwd, lock.token.length > 0 ? { [GATE_LOCK_TOKEN_ENV]: lock.token } : undefined);
-        writeFileSync(abs(attemptLogPath), attempt.output);
-        const locked = isTransientLock(attempt.output);
-        appendFileSync(abs(logFile), attempt.output);
-        rmSync(abs(attemptLogPath), { force: true });
-        gateRc = attempt.code;
-        if (gateRc === 0 || !locked || gateAttempt >= MAX_GATE_ATTEMPTS)
-          break;
-        const line = retryMessage(gateAttempt);
-        process.stdout.write(line);
-        appendFileSync(abs(logFile), line);
-        gateSleep(delayMs);
-      }
-    } finally {
-      setEnvVar(GATE_LOCK_TOKEN_ENV, previousToken);
-      lock.release();
+      gateSleep(delayMs);
     }
     gateRuntimeMs = Date.now() - gateRuntimeStartMs;
-    appendFileSync(abs(logFile), `quality gate lock: queueWaitMs=${queueWaitMs} gateRuntimeMs=${gateRuntimeMs}
+    appendFileSync(abs(logFile), `gate runtime: ${gateRuntimeMs}ms
 `);
   }
   if (gateRc !== 0) {
@@ -30733,7 +30571,6 @@ function runQualityGate(mode, env2, options = {}) {
           }
         ],
         completedAt: new Date().toISOString(),
-        queueWaitMs,
         gateRuntimeMs
       });
       writeFileSync(abs(receiptFile), `${JSON.stringify(receipt, null, 2)}
@@ -30811,7 +30648,6 @@ export {
   isTransientLock,
   extractFindings,
   buildReceipt,
-  acquireGateLock,
   RETRY_DELAY_MS_ENV,
   RETRY_DELAY_MS_DEFAULT,
   RECEIPT_SCHEMA_VERSION,
@@ -30819,12 +30655,6 @@ export {
   MAX_GATE_ATTEMPTS,
   MAX_FINDINGS,
   LOCKED_PATTERN,
-  GATE_LOCK_TOKEN_ENV,
-  GATE_LOCK_POLL_MS_ENV,
-  GATE_LOCK_POLL_MS_DEFAULT,
-  GATE_LOCK_OFF_ENV,
-  GATE_LOCK_MKDIR_HOLD_MS_ENV,
-  GATE_LOCK_DIR_ENV,
   FINDINGS_PATTERN,
   COVERAGE_ROW_PATTERN
 };

package/plugins/sp/scripts/residual-scan.mjs

@@ -15,6 +15,32 @@ function getEnvVars() {
 // plugins/sp/lib/residual-scan.generated.mjs
 import { join } from "node:path";
 import { createHash } from "node:crypto";
+var CLAIM_MARKERS = [
+  /@[a-z0-9._-]+\/[a-z0-9._-]+/i,
+  /\bnode_modules\//,
+  /\b\d+\.\d+\.\d+\b/,
+  /`[A-Za-z_$][\w.$]*\s*\([^`]*\)`/
+];
+var CITATION_FORMS = [
+  /`[^`\s]+:\d+(?:-\d+)?`/,
+  /`[^`]+`\s+lines?\s+\d+/i,
+  /\b[\w./-]+\.[A-Za-z0-9]+:\d+(?:-\d+)?\b/,
+  /https?:\/\/\S+/i
+];
+function hasClaimMarker(evidence) {
+  return CLAIM_MARKERS.some((re) => re.test(evidence));
+}
+function hasCitationForm(evidence) {
+  return CITATION_FORMS.some((re) => re.test(evidence));
+}
+var CONFIDENCE_LEVELS = ["HIGH", "MEDIUM", "LOW"];
+function extractAnswerConfidence(text) {
+  const matches = [...text.matchAll(/^\s*Confidence:\s*(\S+)\s*$/gim)];
+  if (matches.length !== 1)
+    return;
+  const value = (matches[0]?.[1] ?? "").toUpperCase();
+  return CONFIDENCE_LEVELS.includes(value) ? value : undefined;
+}
 var MARKER_PATTERN = /TODO|FIXME|XXX|HACK/;
 var PRIORITY_PATTERN = /^P[1-4]/;
 var RANGE_PRIORITY = /^P[1-4]\s*[\u2013\u2014-]\s*P?[1-4]/;
@@ -41,11 +67,15 @@ function locationOf(locationCell, finding) {
   const backtick = finding.match(/`([^`]+)`/)?.[1];
   return backtick === undefined ? "" : normalizeAnchor(backtick);
 }
-function parseReviewFindings(taskContent) {
+function reviewBody(taskContent) {
   const section = taskContent.split(/^### Review\b/m)[1];
-  if (section === undefined)
+  return section === undefined ? null : section.split(/^### /m)[0] ?? "";
+}
+function parseReviewFindings(taskContent) {
+  const section = reviewBody(taskContent);
+  if (section === null)
     return [];
-  const body = section.split(/^### /m)[0] ?? "";
+  const body = section;
   const out = [];
   const lines = body.split(`
 `);
@@ -158,7 +188,8 @@ function scanResiduals(inputs) {
       "review-finding": true,
       "diff-marker": base !== null,
       "unchecked-box": true,
-      "staging-residue": true
+      "staging-residue": true,
+      "review-contract": false
     },
     items,
     counts
@@ -179,8 +210,36 @@ function blockingReviewFindings(taskContent, deferrals) {
   }));
   return classify(items, [...tableDeferrals, ...deferrals]);
 }
+function reviewContractViolations(taskContent) {
+  const violations = [];
+  const body = reviewBody(taskContent);
+  if (body !== null && extractAnswerConfidence(body.replace(/\*\*/g, "")) === undefined) {
+    violations.push({
+      location: "task-file:Review",
+      text: "Review report carries no single valid `**Confidence:** HIGH | MEDIUM | LOW` line — " + "state the level the report can defend (HIGH: every requirement row MET, every finding " + "dispositioned, evidence cited; MEDIUM/LOW: name the gap)."
+    });
+  }
+  for (const row of parseReviewFindings(taskContent)) {
+    if (hasClaimMarker(row.text) && !hasCitationForm(row.text)) {
+      violations.push({
+        location: row.location.length > 0 ? row.location : "task-file:Review",
+        text: `${row.priority} finding asserts an external API/library/version claim without a ` + "same-cell citation (add a repo `path:line`, an external named-origin form, or a URL " + `to the Finding cell): ${row.text.slice(0, 80)}`
+      });
+    }
+  }
+  return violations;
+}
 function buildReviewGateArtifact(wbs, taskContent, deferrals) {
-  const items = blockingReviewFindings(taskContent, deferrals);
+  const items = [
+    ...blockingReviewFindings(taskContent, deferrals),
+    ...reviewContractViolations(taskContent).map((v) => ({
+      id: makeItemId("review-contract", v.location, v.text),
+      category: "review-contract",
+      class: "blocking",
+      location: v.location,
+      text: v.text
+    }))
+  ];
   const blocking = items.filter((i) => i.class === "blocking");
   const counts = { blocking: 0, deferrable: 0, advisory: 0, housekeeping: 0 };
   for (const item of items)
@@ -192,7 +251,8 @@ function buildReviewGateArtifact(wbs, taskContent, deferrals) {
       "review-finding": true,
       "diff-marker": false,
       "unchecked-box": false,
-      "staging-residue": false
+      "staging-residue": false,
+      "review-contract": true
     },
     items,
     counts
@@ -518,6 +578,12 @@ function settleMode(opts, env, io) {
 }
 function reportMode(opts, env, io) {
   const runDir = join2(opts.root, ".spur", "run");
+  const verdictPath = recordedVerdictPath(runDir, opts.wbs, fs);
+  if (!fs.existsSync(verdictPath)) {
+    io.err(`residual-report: no verdict at ${verdictPath}; nothing to report for ${opts.wbs}
+`);
+    return 0;
+  }
   const sweep = loadVerdict(runDir, opts.wbs).checks.find((c) => c.name === "residual-sweep");
   if (sweep === undefined || sweep.status !== "fail")
     return 0;
@@ -558,6 +624,7 @@ process.exit(main(process.argv.slice(2)));
 export {
   verdictDisagreementNote,
   scanResiduals2 as scanResiduals,
+  reviewContractViolations,
   renderReport,
   recordedVerdictPath,
   parseScanArgs,

package/plugins/sp/scripts/residual-scan.ts

@@ -162,11 +162,8 @@ function settleMode(opts: ParsedArgs, env: ScanEnv, io: ScanIo): number {
     if (fs.existsSync(residualsPath)) prior = JSON.parse(fs.readFileSync(residualsPath, 'utf8'));
     const deferred = scan.items.filter((i) => i.class === 'deferrable');
     if (deferred.length > 0 && prior.followUp === undefined) {
-        // The follow-up is filed UNLINKED: carrying a feature edge to the feature whose run produced
-        // it made that feature's done-gate fail with `L4.verifying-incomplete-tasks` the moment a
-        // residual was deferred (2026-10-04 session, E72/1086→1087), so a deferral must not be able
-        // to block the completing feature. The source task and its feature stay named in the
-        // Background, which keeps the traceability without the lifecycle coupling.
+        // Filed UNLINKED: a feature edge failed that feature's done-gate (`L4.verifying-incomplete-tasks`,
+        // E72/1086→1087); the Background still names the source task and feature for traceability.
         const args = ['task', 'create', `Residuals from ${wbs}`, '--skip-ready', '--json'];
         const created = spur(env, opts.spurBin, args, opts.root);
         let wbsNew = '';
@@ -206,6 +203,12 @@ function settleMode(opts: ParsedArgs, env: ScanEnv, io: ScanIo): number {
 }
 function reportMode(opts: ParsedArgs, env: ScanEnv, io: ScanIo): number {
     const runDir = join(opts.root, '.spur', 'run');
+    // A fix-budget-exhausted run never reaches verify: no verdict is a no-op, not ENOENT (1178 run 1).
+    const verdictPath = core.recordedVerdictPath(runDir, opts.wbs, fs);
+    if (!fs.existsSync(verdictPath)) {
+        io.err(`residual-report: no verdict at ${verdictPath}; nothing to report for ${opts.wbs}\n`);
+        return 0;
+    }
     const sweep = loadVerdict(runDir, opts.wbs).checks.find((c) => c.name === 'residual-sweep');
     if (sweep === undefined || sweep.status !== 'fail') return 0;
     const { content } = loadTask(env, opts.spurBin, opts.wbs, opts.root);