@gobing-ai/spur 0.4.5 → 0.4.7

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.5",
+            "version": "0.4.7",
             "source": "./plugins/sp"
         }
     ]

package/config/config.example.yaml

@@ -66,10 +66,9 @@ bootstrap:
 agent:
   # `default` is the role used for `--agent auto` when the caller declares
   # nothing (task 0542 R2 — the value domain moved from executor names to
-  # roles). A role id selects its tier's cheapest eligible executor; a
-  # configured executor name still resolves during the transition with a
-  # one-time warning (shim agent-default-executor); any other value fails
-  # naming both accepted sets.
+  # roles). A role id selects its tier's cheapest eligible executor; any
+  # other value fails. A configured executor name fails with a fix (use a
+  # role, and pin the executor with --agent <name>).
   default: coder
 
   # Role → tier map (SSOT: DEFAULT_AGENT_ROLES in packages/config, task 0572 /

package/config/config.global.yaml

@@ -35,10 +35,9 @@ version: "1.2"
 agent:
     # `default` is the role used for `--agent auto` when the caller declares
     # nothing (task 0542 R2 — the value domain moved from executor names to
-    # roles). A role id selects its tier's cheapest eligible executor; a
-    # configured executor name still resolves during the transition with a
-    # one-time warning (shim agent-default-executor); any other value fails
-    # naming both accepted sets.
+    # roles). A role id selects its tier's cheapest eligible executor; any
+    # other value fails. A configured executor name fails with a fix (use a
+    # role, and pin the executor with --agent <name>).
     default: coder
 
     # Role → tier map. Resolution: role → tier → cheapest USABLE executor whose

package/config/rules/quality/coverage-gate.yaml

@@ -12,14 +12,16 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # `bun run test:full`. Running this rule directly via `spur rule run` outside the
 # repository wrapper bypasses that certification wrapper and is outside this
 # repository's certification contract. This rule and its evaluator are unchanged.
+# Launcher children write isolated LCOV; canonical publication is exclusive and
+# accepts only that run's complete records. Noncanonical launcher runs cannot
+# overwrite the certified tracefile. Bare `bun test` still bypasses the launcher.
 #
 # Absorbed from ts-libs/.spur/rules/quality/coverage-gate.yaml, re-scoped to
 # Spur's monorepo layout:
 #   - lcovPath kept at .coverage/lcov.info (Spur's `bun run test:coverage`
-#     writes it via --coverage-dir=.coverage, and `bunfig.toml
-#     [test] coverage = true` means a plain `bun run test` writes the same
-#     artifact — so a TARGETED `bun test <file>` overwrites it with a partial
-#     tracefile, and this rule then judges that partial data)
+#     publishes it after a completed run; bare TARGETED `bun test <file>` can
+#     still overwrite it with partial data, which the repository provenance
+#     wrapper refuses before this rule runs)
 #   - include expanded to apps/** + packages/** (Spur tests cover both;
 #     ts-libs only covers packages/**)
 #   - threshold kept at 90 matching bunfig.toml coverageThreshold

package/config/rules/strict/runtime-boundaries.yaml

@@ -78,7 +78,8 @@ rules:
             - "packages/app/src/services/history-anatomy.ts" # deterministic history-anatomy cache core (task 1005 R2): fsync'd tmp+rename atomic publish, readdir digest scans and sync report reads must stay byte-stable; bundled standalone for the bare-node plugin twin (mirrors agent-usage-producer.ts / history-service.ts exemptions)
             - "packages/app/src/observability/workflow-run-log-sink.ts" # sync FD append for mid-run tail-able all-in-one run log (task 0426 / feature D2); append() is sync from the observability bus
             - "packages/app/src/observability/agent-run-log.ts" # same primitive as the sink above for the per-run agent stream (task 1076 R1, ADR-132); append() is sync from the agent service's own onOutput hook, and the byte cap needs the FD position it tracks
-            - "apps/cli/src/commands/workflow.ts" # FD byte-window tail of the mid-run run log for `workflow trace --follow` streaming (task 0428 / feature D2); readSync at offset over the observability sink's FDs
+            # commands/workflow.ts was split per verb (commands/workflow/<verb>.ts); the FD tail lives in trace.ts.
+            - "apps/cli/src/commands/workflow/trace.ts" # FD byte-window tail of the mid-run run log for `workflow trace --follow` streaming (task 0428 / feature D2); readSync at offset over the observability sink's FDs
             - "apps/web/src/modules/discover.ts" # Vite/Astro module scanner fallback under bun test
             - "packages/app/src/services/quality-gate.ts" # gate artifacts (log/findings/receipt) written directly; merged-fd gate log and fsync-free atomic writes must stay byte-stable; bundled standalone for the bare-node plugin twin (task 1006 R1; mirrors history-anatomy.ts)
             - "packages/app/src/workflow/feature-verification-run.ts" # the pass opens the run's single merged log fd (`openSync(path,'a')`) and mkdirs the run dir beside the receipt writer, exactly as the plugin entry did before the move; the fd cannot be expressed through the FileSystem seam (task 1176 R2; same class as the quality-gate exemption above)
@@ -99,8 +100,12 @@ rules:
             - "apps/cli/src/commands/serve.ts" # sync resolveServeCwd() directory validation before server startup (task 0805 R2); mirrors task.ts sync-template exemption
 
             # Synchronous template & workflow resolvers:
-            - "apps/cli/src/commands/task.ts" # sync loadTemplateContent/Bodies callbacks
-            - "packages/app/src/services/workflow-service.ts" # run-log/checkpoint reclamation realpath confinement (:988, :1014)
+            # commands/task.ts was split per verb (commands/task/<verb>.ts); the exempt fs use moved verbatim:
+            - "apps/cli/src/commands/task/shared.ts" # sync loadTemplateContent/Bodies callbacks
+            - "apps/cli/src/commands/task/batch-create.ts" # temp batch payload write + cleanup for `task batch-create` (moved verbatim from task.ts, same exemption)
+            # WorkflowAppService's class body was split into verb modules; the reclamation passes moved verbatim to workflow-clean-ops.ts.
+            - "packages/app/src/services/workflow-clean-ops.ts" # run-log/checkpoint reclamation realpath confinement (cleanRunLogs / cleanScratch, moved verbatim out of workflow-service.ts, same exemption)
+            - "packages/app/src/services/workflow-catalog-scan.ts" # `workflow list` catalogue scan (lstat/readdir newest-mtime walk) moved verbatim out of workflow-service.ts (same exemption)
             - "packages/app/src/workflow/run-record.ts" # confined sync run-record reads: realpath + fstat byte-window (moved from workflow-service.ts, 0962)
             - "apps/cli/src/release-ops.ts" # sync manifest/workspace reads + Bun.write rewrites inside the git release flow (task 0617); mirrors task.ts sync-template exemption
             - "apps/cli/src/version-carriers.ts" # sync manifest reads + Bun.write rewrites for registered release carriers (task 0854); mirrors release-ops.ts sync exemption

package/config/rules/surface/check-cli-surface.yaml

@@ -5,9 +5,15 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 #
 # Part of the recommended-pre-check preset. Run:
 #   spur rule run --preset recommended-pre-check
+#
+# Layout: single-file nouns live at commands/<noun>.ts; large nouns are split
+# into commands/<noun>/{index.ts, <verb>.ts..., shared.ts} (one module per
+# `spur <noun> <verb>`). Both shapes are covered below.
 
 include:
   - "apps/cli/src/commands/*.ts"
+  # Per-noun folders (commands/task/, commands/workflow/, commands/agent/).
+  - "apps/cli/src/commands/*/*.ts"
 
 exclude:
   # Not a command file: shared-options.ts is the option registry.
@@ -19,6 +25,9 @@ rules:
       Every CLI command file must export a registerXxxCommand(program, context)
       function matching the standard Commander.js wiring pattern.
     severity: error
+    exclude:
+      # Per-noun shared.ts holds helpers used by 2+ verbs; it registers nothing.
+      - "apps/cli/src/commands/*/shared.ts"
     evaluator:
       type: rg
       config:
@@ -31,6 +40,17 @@ rules:
       (ADR-091 envelope seam), toJson(), or JSON.stringify() to produce
       machine-readable output.
     severity: error
+    exclude:
+      # Per-noun index.ts only creates the noun and calls each verb's register
+      # function; it declares no options, so there is no --json to back.
+      - "apps/cli/src/commands/*/index.ts"
+      # Verbs that hand JSON rendering to the code that serializes it:
+      # doctor -> AgentService.doctor (spur-app); start/stop -> runAgentLifecycle
+      # in commands/agent/shared.ts (checked). loop declares no --json.
+      - "apps/cli/src/commands/agent/doctor.ts"
+      - "apps/cli/src/commands/agent/loop.ts"
+      - "apps/cli/src/commands/agent/start.ts"
+      - "apps/cli/src/commands/agent/stop.ts"
     evaluator:
       type: rg
       config:

package/config/transition-shims.json

@@ -4,23 +4,9 @@
         {
             "id": "agent-bare-binary-name",
             "wbs": "0536",
-            "file": "packages/app/src/services/agent-service.ts",
+            "file": "packages/app/src/services/agent-resolver.ts",
             "keepsWorking": "a bare coding-agent binary name (codex, omp, claude with no matching agent.executors entry) remains a valid --agent value during the role transition, with a one-time warning emitted by warnBareBinaryOnce",
             "removalCondition": "no bare-binary --agent value remains in docs/, config/workflows/, or plugins/sp/ (scan for --agent <binary-name> usages against agent.executors names)"
-        },
-        {
-            "id": "spec-without-executor-field",
-            "wbs": "0537",
-            "file": "apps/cli/src/commands/agent.ts",
-            "keepsWorking": "a pre-existing agent spec carrying only type (no executor field) still drains: --agent <specId> falls back to the spec's coding-agent type instead of resolving a missing executor",
-            "removalCondition": "every spec under .spur/agents/ records an executor field (scan .spur/agents/*.yaml for the key; re-materialize the demo team first)"
-        },
-        {
-            "id": "agent-default-executor",
-            "wbs": "0542",
-            "file": "packages/app/src/services/agent-service.ts",
-            "keepsWorking": "a configured executor name in agent.default still resolves during the transition, warned once by warnAgentDefaultExecutorOnce; the value domain moved to roles (recommended default: coder)",
-            "removalCondition": "no agent.default value names an agent.executors entry (scan .spur/config.yaml and config/config.example.yaml against the agent.executors names)"
         }
     ]
 }

package/config/workflows/task-lifecycle.yaml

@@ -35,7 +35,7 @@ description: >
   Two-layer done gate (task 0292): this workflow's testing→done guard
   (`spur task check --as done`, F92 R3 — target-aware) is the FIRST gate.
   The CLI verdict guard (`packages/app/src/services/done-transition-guard.ts`)
-  is the SECOND gate, invoked by `apps/cli/src/commands/task.ts` for every
+  is the SECOND gate, invoked by `apps/cli/src/commands/task/update.ts` for every
   `spur task update <wbs> done` call — it reads `.spur/run/<wbs>-verdict.json`
   and blocks non-PASS verdicts unless `--force-done --reason "<why>"` is
   supplied. The CLI gate covers the `--no-lifecycle` and adapter-unavailable

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.5",
+    "version": "0.4.7",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/plugins/sp/commands/dev-changelog.md

@@ -26,5 +26,5 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 ## Implementation
 
-Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#8-changelog) (changelog). This is a docs-only generator: run no quality gates (`bun run gate`, lint, typecheck, tests, `spur-check`, rules, citation checks) — a generic "verify before finishing" rule does not apply here.
+Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#8-changelog) (changelog). This is a docs-only generator: run no quality gates (`bun run gate`, lint, typecheck, tests, `spur-check`, rules) — a generic "verify before finishing" rule does not apply here. The generator's own claim-verification pass (dev-operations §8, step 7: API/library claims get `<!-- src: … · HIGH|MEDIUM|LOW -->` citations) is part of the procedure, not a gate.