@sporhq/spor 0.28.0 → 0.28.1

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "spor",
   "displayName": "Spor Context Compiler",
   "description": "Maintains a typed, versioned knowledge graph and compiles compact briefings from it: session-start injection, per-prompt relevance digests, capture at discovery, end-of-session distillation, decision queue.",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "author": {
     "name": "losthammer"
   }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "spor",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "Maintains a typed, versioned knowledge graph and compiles compact briefings from it: session-start injection, per-prompt relevance digests, capture at discovery, end-of-session distillation, decision queue.",
   "author": {
     "name": "Spor",

package/bin/spor.js

@@ -7906,7 +7906,13 @@ function worktreeDeclaredEnv(dir) {
 function removeDispatchWorktree(repoDir, dir, branch) {
   const common = (git(dir, ["rev-parse", "--path-format=absolute", "--git-common-dir"]).stdout || "").trim();
   const mainCheckout = common ? path.dirname(common) : "";
-  if (!mainCheckout || path.resolve(mainCheckout) !== path.resolve(repoDir)) {
+  // Compared CANONICALIZED (u.canonPath): git answers in the long, resolved
+  // form, while `repoDir` is whatever the caller spelled — an 8.3 short name
+  // on Windows (os.tmpdir() is `…\RUNNER~1\…` on the CI runner), a
+  // /var -> /private/var symlink on macOS — and a spelling mismatch here read
+  // as "not a worktree of repoDir", stranding the half-prepped worktree the
+  // guard exists to clean up (inc-spor-windows-ci-main-failing).
+  if (!mainCheckout || u.canonPath(mainCheckout) !== u.canonPath(repoDir)) {
     return { removed: false, reason: `${dir} is not a worktree of ${repoDir} — refusing to remove` };
   }
   const status = git(dir, ["status", "--porcelain"]);
@@ -8119,10 +8125,17 @@ const DISPATCH_RUNNER = path.join(ROOT, "lib", "shell", "agent-dispatch-runner.j
 // startup, exercising launchSupervisedHarness's supervisor-exited-early
 // branch deterministically instead of relying on a real startup crash/OOM to
 // happen to occur (task-spor-dispatch-supervisor-test-seam). Unset (the
-// default) reproduces the exact prior invocation.
+// default) reproduces the exact prior invocation. A `.js` override runs under
+// THIS node, like the real runner: the supervisor is spawned with no shell
+// (its handshake rides an extra stdio pipe a cmd.exe hop would not inherit),
+// and Node refuses a bare `.cmd`/`.bat` spawn on Windows (EINVAL,
+// CVE-2024-27980), so a script is the one override shape that launches the
+// same way on every platform.
 function dispatchRunnerCommand(env = process.env) {
   const override = env.SPOR_DISPATCH_RUNNER_CMD;
-  return override ? { cmd: override, args: [] } : { cmd: process.execPath, args: [DISPATCH_RUNNER] };
+  if (!override) return { cmd: process.execPath, args: [DISPATCH_RUNNER] };
+  if (/\.js$/i.test(override)) return { cmd: process.execPath, args: [override] };
+  return { cmd: override, args: [] };
 }
 
 function writePrivate(file, text) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sporhq/spor",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "Spor — a shared memory substrate for teams and agents. Decisions, their reasons, and the traces they leave. Knowledge-graph context compiler: session-start briefings, per-prompt digests, capture at discovery, end-of-session distillation, decision queue.",
   "license": "Apache-2.0",
   "author": "Anthony Allen",