@gobing-ai/spur 0.4.17 → 0.4.18

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.17",
+            "version": "0.4.18",
             "source": "./plugins/sp"
         }
     ]

package/config/workflows/task-pipeline.yaml

@@ -661,12 +661,12 @@ states:
                 # which this pointer names.
                 input: >-
                     /sp:dev-review --tasks ${vars.wbs} --auto --focus ${vars.reviewFocus} Answer contract (full: super-reviewer Output
-                    Format). Two artifacts: the `## Review` section (dispositions, deriveReviewConfidence) and your captured answer
-                    (certification input for `spur task verdict`). The answer has one `Confidence: HIGH|MEDIUM|LOW` line, EVIDENCE-derived
-                    (deriveVerifyConfidence), never the section's disposition level. End with one `Verdict: PASS|PARTIAL|FAIL` line
-                    preceded by `| Req | Status | Evidence |` (one row per requirement; MET | PARTIAL | UNMET) and `| AC | Status |
-                    Evidence Type | Evidence |` (one row per AC; MET | PARTIAL | UNMET | N/A). Evidence types (`+` compound allowed): test
-                    | command | static-ref | manual-review | llm-judge | n/a. Evidence cells cite `path:line` or a named check. AC rows
+                    Format). Two artifacts: the `## Review` section (deriveReviewConfidence) and your captured answer
+                    (`spur task verdict` input). The answer has one `Confidence: HIGH|MEDIUM|LOW` line, EVIDENCE-derived
+                    (deriveVerifyConfidence), never the section's disposition level. End with one `Verdict: PASS|PARTIAL|FAIL` line after `| Req | Status | Evidence |` (one row per requirement; MET | PARTIAL | UNMET) and `| AC | Status |
+                    Evidence Type | Evidence |` (one row per AC; MET | PARTIAL | UNMET | N/A). Evidence types (`+` ok): test
+                    | command | static-ref | manual-review | llm-judge | n/a. Evidence cells cite a repo-root-relative `path:line`
+                    (never `/tmp`: out-of-repo blocks done) or a named check. AC rows
                     key on the task's identities or a declared `AC-N` alias; a linked scenario covers its task and a task-local criterion
                     needs no feature credit. Open P1-P3 blocks completion.
                 # The captured review answer is the run's certification input (and the

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.17",
+    "version": "0.4.18",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/plugins/sp/agents/super-reviewer.md

@@ -265,7 +265,9 @@ this exact shape:
 One row per declared requirement (`MET | PARTIAL | UNMET`, none omitted or merged) and one row per
 acceptance criterion (`MET | PARTIAL | UNMET | N/A`), with the evidence-type token alone in its own
 cell — `test | command | static-ref | manual-review | llm-judge | n/a`, or a `+` compound when more
-than one kind applies. Evidence cells cite a repo-relative `path:line` or a named test/command. AC
+than one kind applies. Evidence cells cite a repo-root-relative `path:line` or a named test/command.
+An absolute path outside the repo (`/tmp/<report>.md:12`) is an unresolved anchor that blocks the
+done projection (`L4.anchor-unresolved`); cite the owning source or a corpus artifact instead. AC
 identities stay the task's own (checklist label, title, bold head, `Scenario:` prefix, bracket tag or
 declared `AC-N` alias): a linked feature's scenario title covers the task that implements it, and a
 task-local criterion is legal as-is — it needs no feature credit.

package/plugins/sp/plugin.json

@@ -1,5 +1,5 @@
 {
     "name": "sp",
-    "version": "0.4.17",
+    "version": "0.4.18",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics."
 }

package/spur.js

@@ -120938,11 +120938,16 @@ async function persistWorktreeRuns(input) {
   if (fromStat === undefined || !fromStat.isDirectory()) {
     throw new Error(`persist-out: source worktree does not exist or is not a directory: ${input.fromWorkdir}`);
   }
+  const fs = createNodeFileSystem2();
+  const fromReal = fs.realPath?.(fromDir) ?? fromDir;
+  const toReal = fs.realPath?.(toDir) ?? toDir;
+  if (fromReal === toReal) {
+    throw new Error(`persist-out: source and destination are the same tree (${fromDir}) \u2014 run it from the invoking tree, or the evidence is copied onto itself and lost with the worktree`);
+  }
   const fromRunDir = join67(fromDir, ".spur", "run");
   const toRunDir = join67(toDir, ".spur", "run");
   const fromRecordsDir = runStoragePaths(fromDir).recordsDir;
   const toRecordsDir = runStoragePaths(toDir).recordsDir;
-  const fs = createNodeFileSystem2();
   const fromEvidence = runStoragePaths(fromDir).evidenceDir;
   const toEvidence = runStoragePaths(toDir).evidenceDir;
   const evidenceCopies = [];
@@ -146882,7 +146887,7 @@ import { createRequire as createRequire3 } from "module";
 var CLI_CONFIG = {
   binaryName: "spur",
   binaryLabel: "spur",
-  binaryVersion: "0.4.17",
+  binaryVersion: "0.4.18",
   configDir: ".spur",
   configFile: ".spur/config.yaml",
   databaseFile: ".spur/spur.db"
@@ -156730,7 +156735,7 @@ init_dist5();
 import { homedir as homedir17 } from "os";
 import { basename as basename20, join as join94, relative as relative19, resolve as resolve37 } from "path";
 // ../server/package.json
-var version3 = "0.4.17";
+var version3 = "0.4.18";
 
 // ../server/src/modules/health/index.ts
 var startedAt = Date.now();
@@ -161784,6 +161789,7 @@ function registerWorkflowCleanCommand(workflow, context) {
 }
 
 // ../../packages/app/src/workflow/commit-guard.ts
+init_src();
 init_dist5();
 import { mkdirSync as mkdirSync23, readFileSync as readFileSync28, renameSync as renameSync10, writeFileSync as writeFileSync20 } from "fs";
 import { join as join100 } from "path";
@@ -161954,6 +161960,26 @@ function commitGuardStage(run, paths, options = {}) {
     foreign
   };
 }
+function foreignSessionOwner(cwd) {
+  try {
+    const raw = JSON.parse(readFileSync28(join100(cwd, ".spur", "context", ".session.json"), "utf8"));
+    const sessionId = typeof raw.owner?.sessionId === "string" ? raw.owner.sessionId : "";
+    if (sessionId === "")
+      return null;
+    const current = currentHostSessionId();
+    if (current === "" || current === sessionId)
+      return null;
+    return { host: typeof raw.owner?.host === "string" ? raw.owner.host : "unknown", sessionId };
+  } catch {
+    return null;
+  }
+}
+function currentHostSessionId() {
+  const transcript = getEnvVar("PI_SESSION_FILE") ?? "";
+  const stem = transcript.replace(/\.jsonl$/, "").split("/").pop() ?? "";
+  const pi = stem.includes("_") ? stem.split("_").pop() ?? "" : "";
+  return pi !== "" ? pi : (getEnvVar("CLAUDE_CODE_SESSION_ID") ?? "").trim();
+}
 function commitGuardCheck(run, options = {}) {
   try {
     const context = runContext(run, options);
@@ -161961,7 +161987,11 @@ function commitGuardCheck(run, options = {}) {
       return missingStart(run);
     const { base, git, written } = context;
     const foreign = [...changedSinceBase(base, git)].filter((path) => !written.has(path)).sort();
-    return report(0, [JSON.stringify({ foreign })]);
+    const owner = foreignSessionOwner(options.cwd ?? process.cwd());
+    const stderr = owner ? [
+      `commit-guard: another session owns this tree \u2014 .spur/context/.session.json records ${owner.host} ${owner.sessionId}; use a separate worktree (one writer per tree)`
+    ] : [];
+    return { ...report(0, [JSON.stringify({ foreign, ...owner ? { foreignSession: owner } : {} })], stderr) };
   } catch (err) {
     return report(1, [], [probeDiagnostic(err)]);
   }