@biffo/cli 0.249.7 → 0.249.9

package/_skeletons/plugin-template/.githooks/pre-commit

@@ -16,13 +16,39 @@ cd "$root" || exit 0
 #
 # Unlike commit-msg, which now has a built-in fallback because Conventional
 # Commits is a RULE that can be checked with nothing but `sh`, this hook runs a
-# TOOLCHAIN. Checked 2026-08-03: no satellite carries `lint-staged` anywhere --
-# not at the root, not in any workspace -- so there is genuinely nothing to
-# resolve and nothing to fall back to. Making it fatal would block all work in
-# those repos, which is how a safety measure gets ripped out.
+# TOOLCHAIN. There is genuinely nothing to resolve and nothing to fall back to
+# where it is absent, and making it fatal would block all work in those repos,
+# which is how a safety measure gets ripped out.
 #
 # So it still exits 0. It just no longer implies it checked anything, and it
 # says what would make it real.
+#
+# ## The abstention is not the end state, and the count is moving
+#
+# An earlier version of this comment recorded "Checked 2026-08-03: no satellite
+# carries `lint-staged` anywhere". That is no longer true, and leaving it would
+# have made a fixable gap read as a permanent fact about satellites -- the
+# abstention would look like the design rather than a backlog.
+#
+# Re-measured 2026-08-06 across the nine tabsii satellites:
+#
+#   - `tabsii-crm` DOES carry it, and its gate is real.
+#   - `tabsii-ui` gained it the same day (tabsii-ui#24), which also showed the
+#     abstention is cheap to clear: add prettier + lint-staged and a config.
+#   - Seven others still abstain. THREE of those have no root `package.json` at
+#     all, so they hit the FIRST branch below, and no config file can fix them --
+#     they need a root manifest before they need a lint-staged entry.
+#
+# The deeper reason it keeps happening: **`.prettierrc` is not in
+# `shared-files.json`**, so nothing ever carries the estate's formatting rules
+# to a satellite. Each one is left to invent them or have none, and a satellite
+# that adopts prettier with DEFAULTS drifts away from the estate's style rather
+# than towards it -- measured in tabsii-ui, where prettier's defaults reformatted
+# all 7 source files and the template's settings reformatted 3.
+#
+# Do not re-freeze a measured count into this comment without a date and a way
+# to re-derive it. The number is a snapshot of a backlog, not a property of
+# satellites.
 if [ ! -f package.json ]; then
   echo "pre-commit: ABSTAINED — no root package.json, so lint-staged cannot run here." >&2
   echo "  Staged files were NOT linted or formatted. CI still checks them." >&2

package/_skeletons/plugin-template/scripts/py-dependency-audit.sh

@@ -205,7 +205,32 @@ for lock in $ALL_LOCKS; do
 
   # `--no-emit-project` drops the tree's own package (nothing published to
   # audit); `--no-dev` keeps the audit to what actually ships.
-  if (cd "$dir" && uv export --frozen --no-dev --no-emit-project) >"$reqs" 2>/dev/null && [ -s "$reqs" ]; then
+  #
+  # `--no-emit-local` drops LOCAL PATH dependencies, and without it this gate
+  # cannot scan a plugin tree at all (#1340). `biffo-plugin-sdk` is pulled in
+  # as `-e ./packages/python-sdk`; pip-audit tries to resolve it on PyPI, fails
+  # with "Dependency not found on PyPI and could not be audited", and produces
+  # no parseable output -- so the whole tree came back INCONCLUSIVE and blocked.
+  # Every vendored Python plugin tree in every instance has that dependency, so
+  # this was not a niche shape: it blocked all of them.
+  #
+  # Skipping it costs nothing real. A local path dependency is first-party
+  # source, audited in its own repo, and never a published artefact an advisory
+  # could name. Its TRANSITIVE dependencies are still exported and still
+  # audited -- verified on `services/ideation`, where the export keeps 25
+  # packages including three carried `via biffo-plugin-sdk`. So the answer this
+  # gate gives is unchanged for every package an advisory can actually be about.
+  if (cd "$dir" && uv export --frozen --no-dev --no-emit-project --no-emit-local) >"$reqs" 2>/dev/null && [ -s "$reqs" ]; then
+    # Report what was skipped rather than skipping it quietly: "audited
+    # everything except the bits we could not" must never read the same as
+    # "audited everything", which is the failure this whole file exists to
+    # fight. Counted from the same lockfile, so the number is the tree's, not
+    # a guess.
+    local_deps=$( (cd "$dir" && uv export --frozen --no-dev --no-emit-project) 2>/dev/null \
+      | grep -cE '^-e |@ file://' || true )
+    if [ "${local_deps:-0}" -gt 0 ]; then
+      echo "  (${rel}: ${local_deps} local path dependenc$([ "$local_deps" -eq 1 ] && echo y || echo ies) excluded -- first-party, audited in their own repo; their transitive dependencies are still scanned)"
+    fi
     audit_deps "pip-audit (${rel})" "-r $reqs" || failed=1
   else
     # An export failure is "couldn't run", not "clean" — same discipline as a

package/_skeletons/sibling-template/.githooks/pre-commit

@@ -16,13 +16,39 @@ cd "$root" || exit 0
 #
 # Unlike commit-msg, which now has a built-in fallback because Conventional
 # Commits is a RULE that can be checked with nothing but `sh`, this hook runs a
-# TOOLCHAIN. Checked 2026-08-03: no satellite carries `lint-staged` anywhere --
-# not at the root, not in any workspace -- so there is genuinely nothing to
-# resolve and nothing to fall back to. Making it fatal would block all work in
-# those repos, which is how a safety measure gets ripped out.
+# TOOLCHAIN. There is genuinely nothing to resolve and nothing to fall back to
+# where it is absent, and making it fatal would block all work in those repos,
+# which is how a safety measure gets ripped out.
 #
 # So it still exits 0. It just no longer implies it checked anything, and it
 # says what would make it real.
+#
+# ## The abstention is not the end state, and the count is moving
+#
+# An earlier version of this comment recorded "Checked 2026-08-03: no satellite
+# carries `lint-staged` anywhere". That is no longer true, and leaving it would
+# have made a fixable gap read as a permanent fact about satellites -- the
+# abstention would look like the design rather than a backlog.
+#
+# Re-measured 2026-08-06 across the nine tabsii satellites:
+#
+#   - `tabsii-crm` DOES carry it, and its gate is real.
+#   - `tabsii-ui` gained it the same day (tabsii-ui#24), which also showed the
+#     abstention is cheap to clear: add prettier + lint-staged and a config.
+#   - Seven others still abstain. THREE of those have no root `package.json` at
+#     all, so they hit the FIRST branch below, and no config file can fix them --
+#     they need a root manifest before they need a lint-staged entry.
+#
+# The deeper reason it keeps happening: **`.prettierrc` is not in
+# `shared-files.json`**, so nothing ever carries the estate's formatting rules
+# to a satellite. Each one is left to invent them or have none, and a satellite
+# that adopts prettier with DEFAULTS drifts away from the estate's style rather
+# than towards it -- measured in tabsii-ui, where prettier's defaults reformatted
+# all 7 source files and the template's settings reformatted 3.
+#
+# Do not re-freeze a measured count into this comment without a date and a way
+# to re-derive it. The number is a snapshot of a backlog, not a property of
+# satellites.
 if [ ! -f package.json ]; then
   echo "pre-commit: ABSTAINED — no root package.json, so lint-staged cannot run here." >&2
   echo "  Staged files were NOT linted or formatted. CI still checks them." >&2

package/_skeletons/sibling-template/scripts/py-dependency-audit.sh

@@ -205,7 +205,32 @@ for lock in $ALL_LOCKS; do
 
   # `--no-emit-project` drops the tree's own package (nothing published to
   # audit); `--no-dev` keeps the audit to what actually ships.
-  if (cd "$dir" && uv export --frozen --no-dev --no-emit-project) >"$reqs" 2>/dev/null && [ -s "$reqs" ]; then
+  #
+  # `--no-emit-local` drops LOCAL PATH dependencies, and without it this gate
+  # cannot scan a plugin tree at all (#1340). `biffo-plugin-sdk` is pulled in
+  # as `-e ./packages/python-sdk`; pip-audit tries to resolve it on PyPI, fails
+  # with "Dependency not found on PyPI and could not be audited", and produces
+  # no parseable output -- so the whole tree came back INCONCLUSIVE and blocked.
+  # Every vendored Python plugin tree in every instance has that dependency, so
+  # this was not a niche shape: it blocked all of them.
+  #
+  # Skipping it costs nothing real. A local path dependency is first-party
+  # source, audited in its own repo, and never a published artefact an advisory
+  # could name. Its TRANSITIVE dependencies are still exported and still
+  # audited -- verified on `services/ideation`, where the export keeps 25
+  # packages including three carried `via biffo-plugin-sdk`. So the answer this
+  # gate gives is unchanged for every package an advisory can actually be about.
+  if (cd "$dir" && uv export --frozen --no-dev --no-emit-project --no-emit-local) >"$reqs" 2>/dev/null && [ -s "$reqs" ]; then
+    # Report what was skipped rather than skipping it quietly: "audited
+    # everything except the bits we could not" must never read the same as
+    # "audited everything", which is the failure this whole file exists to
+    # fight. Counted from the same lockfile, so the number is the tree's, not
+    # a guess.
+    local_deps=$( (cd "$dir" && uv export --frozen --no-dev --no-emit-project) 2>/dev/null \
+      | grep -cE '^-e |@ file://' || true )
+    if [ "${local_deps:-0}" -gt 0 ]; then
+      echo "  (${rel}: ${local_deps} local path dependenc$([ "$local_deps" -eq 1 ] && echo y || echo ies) excluded -- first-party, audited in their own repo; their transitive dependencies are still scanned)"
+    fi
     audit_deps "pip-audit (${rel})" "-r $reqs" || failed=1
   else
     # An export failure is "couldn't run", not "clean" — same discipline as a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.249.7",
+  "version": "0.249.9",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",