Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsBlogPro
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Authors
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges
  • Chrome Extension
  • Skill Manager

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

ProTermsPrivacyRefunds
Back to skills

Spur Update

ASecurity

Roll a Spur host onto a published npm version by hand and verify it, when the automatic path fails. Use when `spur update` rolled back, the UI version switch reports failed, the dashboard shows a stale or 0.0.0 version, or the daemon stays unreachable after a version change. Don't use for cutting a release, for publishing to npm, or for a Spur running from a repo checkout.

3 stars
0 votes
0 copies
0 views
Added 10/2/2026
toolsbashnode

Works with

terminalcli

Security Analysis

A92/100
mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned 10/2/2026

$npx -y skills add ashugaev/spur --skill spur-update --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Spur Update?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Spur Update
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/ashugaev-spur-update/badge)](https://www.skillsdirectory.com/skills/ashugaev-spur-update)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
Files
SKILL.md
---
name: spur-update
description: Roll a Spur host onto a published npm version by hand and verify it, when the automatic path fails. Use when `spur update` rolled back, the UI version switch reports failed, the dashboard shows a stale or 0.0.0 version, or the daemon stays unreachable after a version change. Don't use for cutting a release, for publishing to npm, or for a Spur running from a repo checkout.
---

SPUR UPDATE BY HAND

Recover a host onto a published version when the automatic update fails. Host-generic: any box running the npm-installed Spur.

LAYOUT

  package       @shugaev/spur on npm
  install       <prefix>/lib/node_modules/@shugaev/spur, prefix derived from the running package path
  units         spur-daemon.service, spur-web.service, user scope
  helper        <install>/scripts/install-and-restart.sh <version>, the script the UI version switch spawns
  helper log    ~/.spur/logs/install-and-restart.log, the helper's only output sink
  lock          ~/.spur/install-and-restart.lock, shared with `spur update`, waits 600s
  update state  ~/.spur/rollback-state.json
  switch state  deploy-switch.json in the Spur data dir

THREE PATHS, CHEAPEST FIRST

  1  spur update [version] — installs, monitors, auto-rolls-back. Flags: `spur update --help`.
  2  bash <install>/scripts/install-and-restart.sh <version> — what the UI click runs. Prints nothing to the terminal; read the helper log.
  3  npm install -g --prefix <prefix> @shugaev/spur@<version>, then <prefix>/bin/spur reinit — no monitor, no rollback.

Paths 2 and 3 carry no health monitor. Verify by hand after either.

DIAGNOSE FIRST

  <prefix>/bin/spur --version
  node -p "require('<install>/package.json').version"
  npm view @shugaev/spur version
  systemctl --user is-active spur-daemon spur-web
  tail -n 40 ~/.spur/logs/install-and-restart.log

CLI version and package.json version disagree: a restart is pending.

VERIFY AFTER

  systemctl --user is-active spur-daemon spur-web
  curl -fsS -o /dev/null -w 'daemon %{http_code}\n' http://127.0.0.1:4310/sessions
  curl -fsS -o /dev/null -w 'web %{http_code}\n' http://127.0.0.1:<web-port>/

Pass: both units active, daemon 200, web 200, `spur --version` equal to the target. Web port lives in spur-web.service as `Environment=PORT=`; read it there.

READINESS

  A registry holding many configs and sources leaves the daemon answering 503 for over 20 seconds after systemd reports the unit active. Poll both endpoints before calling a deploy failed.
  reinit rc=1 with both units active means the readiness poll expired, not a dead unit. Re-poll; two 200s close the deploy.

TRAPS

  - `npm install -g` without `--prefix` lands in npm's configured prefix, not the live install. Derive the prefix from the running package path.
  - A locally packed tarball carries the repo placeholder version, and the dashboard then shows 0.0.0. Only a registry version carries a real semver. Never hand-deploy a packed tarball to a host that needs a version number.
  - Rollback matches the previous version against semver. From a placeholder install no rollback runs and the host stays on the new version.
  - A stale `running` phase in the switch state 409s each later UI switch.
  - `spur update` refuses on a live update monitor and on a failing preflight, `--force` overrides both. A daemon answering 503 fails preflight. An `inProgress` record whose monitor is dead blocks nothing.
  - `spur update` refuses a source checkout.
  - A non-default SYSTEMCTL restarts the units directly and skips the unit refresh. Unit contracts change across versions.
  - No published version carries the fix: the release pipeline is the defect. Repair it; hand-rolling reaches published versions only.

Attribution

ashugaevashugaev
View sourceSee grades on GitHubMore from ashugaev →
SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Related Skills

ucoz-landing-skill

Create and edit uCoz homepage landing pages via MCP: custom templates, hero sections, lead forms, navigation menus, SEO, and responsive layout. Includes a visual design system (style selection, layout/grid, section recipes, typography/spacing, color tokens, component states, icons, modern CSS/JS, motion, imagery, social proof, copy/voice, accessibility). Uses ucoz-mcp tools for templates, site file uploads, and site modules.

107 votes

Paperclip

Interact with the Paperclip control plane API for task coordination and governance. Use when checking assignments, updating issue status, posting comments, delegating work, managing routines, or calling Paperclip API endpoints.

953191 votes

Pptx

Presentation toolkit (.pptx). Create/edit slides, layouts, content, speaker notes, comments, for programmatic presentation creation and modification.

471861 votes

Daw Music

Digital Audio Workstation usage, music composition, interactive music systems, and game audio implementation for immersive soundscapes.

761 votes

Instantly Rdsthomas Mission Control

Instantly.ai cold email outreach API - manage campaigns, leads, accounts, and analytics. Use for cold email automation, lead management, campaign creation/monitoring, and email account warmup.

761 votes
View all in tools →