@biffo/cli 0.267.2 → 0.267.4

package/dist/index.js

@@ -377,12 +377,12 @@ function toPosix(p) {
 function listTemplateOwnedFiles(root, manifest, options = {}) {
   const out = [];
   const tracked = options.trackedOnly ? options.git ? gitTrackedFiles(root, options.git) : gitTrackedFiles(root) : null;
-  function walk(dir) {
+  function walk2(dir) {
     for (const entry of readdirSync(dir, { withFileTypes: true })) {
       if (entry.isDirectory() && HARD_EXCLUDED_DIRS.has(entry.name)) continue;
       const abs = join2(dir, entry.name);
       if (entry.isDirectory()) {
-        walk(abs);
+        walk2(abs);
       } else if (entry.isFile()) {
         const rel = toPosix(relative(root, abs));
         if (tracked && !tracked.has(rel)) continue;
@@ -390,7 +390,7 @@ function listTemplateOwnedFiles(root, manifest, options = {}) {
       }
     }
   }
-  walk(root);
+  walk2(root);
   return out.sort();
 }
 function sameFile(a, b) {
@@ -6030,12 +6030,12 @@ function formatStaleBuildError(result) {
 }
 function collectSourceFiles(srcDir) {
   const found = [];
-  const walk = (dir) => {
+  const walk2 = (dir) => {
     for (const entry of readdirSync7(dir, { withFileTypes: true })) {
       const full = join19(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules") continue;
-        walk(full);
+        walk2(full);
         continue;
       }
       if (!entry.isFile()) continue;
@@ -6045,7 +6045,7 @@ function collectSourceFiles(srcDir) {
       found.push(full);
     }
   };
-  walk(srcDir);
+  walk2(srcDir);
   return found;
 }
 function findPackageRoot(from) {
@@ -7834,7 +7834,7 @@ function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
   }
   const skipped = [];
   const files = [];
-  const walk = (relDir) => {
+  const walk2 = (relDir) => {
     const absDir = join25(skeletonRoot, relDir);
     for (const entry of readdirSync11(absDir, { withFileTypes: true }).sort(
       (a, b) => a.name.localeCompare(b.name)
@@ -7846,7 +7846,7 @@ function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
       }
       const relPath = relDir ? `${relDir}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
-        walk(relPath);
+        walk2(relPath);
         continue;
       }
       const destRel = applySubstitutions(relPath, names);
@@ -7863,7 +7863,7 @@ function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
       files.push(destRel);
     }
   };
-  walk("");
+  walk2("");
   if (!files.some((f) => f.startsWith("terraform/"))) {
     throw new Error(
       `Scaffold produced no terraform/ files from ${skeletonRoot} \u2014 refusing to leave a plugin whose event subscriptions could never fire (issue #194).`
@@ -9872,13 +9872,142 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
   console.log(`\u2713 branch-protection guard: ${owner}/${repo} (${audited.join(", ")}) OK`);
 }
 
-// src/scripts/check-core-direct-paths.ts
-import { join as join37 } from "path";
+// src/scripts/check-cognito-invite-template.ts
 import { execa as execa7 } from "execa";
 
-// src/lib/core-direct-paths-audit.ts
-import { readFileSync as readFileSync27, readdirSync as readdirSync14, statSync as statSync7 } from "fs";
+// src/lib/cognito-invite-template-guard.ts
+import { readdirSync as readdirSync14, readFileSync as readFileSync27, statSync as statSync7 } from "fs";
 import { join as join36 } from "path";
+var REQUIRED_INVITE_MEMBERS = ["email_subject", "email_message", "sms_message"];
+var REQUIRED_INVITE_PLACEHOLDERS = ["{username}", "{####}"];
+var PLACEHOLDER_MEMBERS = ["email_message", "sms_message"];
+function stripHeredocs(source) {
+  return source.replace(/<<-?(\w+)\r?\n[\s\S]*?\r?\n[ \t]*\1\b/g, '"HEREDOC"');
+}
+function stripHclComments(source) {
+  return source.replace(/\/\*[\s\S]*?\*\//g, "").split("\n").map((line) => line.replace(/(^|\s)(#|\/\/).*$/, "$1")).join("\n");
+}
+function extractBlocks(source, name) {
+  const blocks = [];
+  const opener = new RegExp(`(?:^|[\\s])${name}\\s*\\{`, "g");
+  let match;
+  while ((match = opener.exec(source)) !== null) {
+    const openBrace = source.indexOf("{", match.index);
+    let depth = 1;
+    let i = openBrace + 1;
+    for (; i < source.length && depth > 0; i++) {
+      if (source[i] === "{") depth++;
+      else if (source[i] === "}") depth--;
+    }
+    blocks.push({
+      line: source.slice(0, match.index).split("\n").length,
+      body: source.slice(openBrace + 1, i - 1)
+    });
+  }
+  return blocks;
+}
+function checkInviteTemplateSource(file, rawSource) {
+  const source = stripHclComments(stripHeredocs(rawSource));
+  const violations = [];
+  for (const block of extractBlocks(source, "invite_message_template")) {
+    for (const member of REQUIRED_INVITE_MEMBERS) {
+      const assigned = new RegExp(`(?:^|[\\s{])${member}\\s*=`).test(block.body);
+      if (!assigned) {
+        violations.push({
+          file,
+          line: block.line,
+          message: `invite_message_template is missing "${member}". Cognito's CreateUserPool validates all of ${REQUIRED_INVITE_MEMBERS.join(", ")} and rejects an empty member with InvalidParameterException ("length greater than or equal to 6"), so no user pool can be created and every fresh deploy fails (issue #356).`
+        });
+      }
+    }
+  }
+  for (const block of extractBlocks(rawSource, "invite_message_template")) {
+    for (const member of PLACEHOLDER_MEMBERS) {
+      const body = memberBody(block.body, member);
+      if (body === null) continue;
+      for (const placeholder of REQUIRED_INVITE_PLACEHOLDERS) {
+        if (!body.includes(placeholder)) {
+          violations.push({
+            file,
+            line: block.line,
+            message: `invite_message_template's "${member}" is missing the ${placeholder} placeholder. Cognito's CreateUserPool rejects the template outright ("${member === "sms_message" ? "SMS message" : "Email message body"} should have ${placeholder} which will be replaced by code"), so no user pool can be created. Note {username} is required even when the pool uses username_attributes and the value is an opaque UUID \u2014 keep it, but do not ask the recipient to type it.`
+          });
+        }
+      }
+    }
+  }
+  return violations;
+}
+function memberBody(blockBody, member) {
+  const heredoc = new RegExp(
+    `(?:^|[\\s{])${member}\\s*=\\s*<<-?([A-Za-z_]+)([\\s\\S]*?)^\\s*\\1`,
+    "m"
+  );
+  const heredocMatch = heredoc.exec(blockBody);
+  if (heredocMatch?.[2] !== void 0) return heredocMatch[2];
+  const quoted = new RegExp(`(?:^|[\\s{])${member}\\s*=\\s*"((?:[^"\\\\]|\\\\.)*)"`);
+  const quotedMatch = quoted.exec(blockBody);
+  return quotedMatch?.[1] ?? null;
+}
+function findModuleTerraformFiles(repoRoot) {
+  const found = [];
+  const walk2 = (dir, relative8) => {
+    let entries;
+    try {
+      entries = readdirSync14(dir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
+      const full = join36(dir, entry);
+      const rel = `${relative8}/${entry}`;
+      if (statSync7(full).isDirectory()) {
+        walk2(full, rel);
+      } else if (entry.endsWith(".tf")) {
+        found.push(rel);
+      }
+    }
+  };
+  walk2(join36(repoRoot, "modules"), "modules");
+  return found.sort();
+}
+function checkCognitoInviteTemplates(repoRoot) {
+  return findModuleTerraformFiles(repoRoot).flatMap(
+    (file) => checkInviteTemplateSource(file, readFileSync27(join36(repoRoot, file), "utf8"))
+  );
+}
+
+// src/scripts/check-cognito-invite-template.ts
+async function runCognitoInviteTemplateCheck() {
+  const root = (await execa7("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const files = findModuleTerraformFiles(root);
+  console.log(`audited ${files.length} .tf file(s) under modules/ under ${root}`);
+  if (files.length === 0) {
+    console.error(
+      "\u2717 Cognito invite template guard: found 0 .tf files under modules/ \u2014 this looks like a broken scan, not a clean repo. Refusing to report success over zero input."
+    );
+    process.exit(1);
+  }
+  const violations = checkCognitoInviteTemplates(root);
+  if (violations.length > 0) {
+    console.error("\u2717 Cognito invite template guard: incomplete invite_message_template(s)\n");
+    for (const v of violations) {
+      console.error(`  ${v.file}:${v.line}  ${v.message}`);
+    }
+    console.error("\nSee biffo-template#356.");
+    process.exit(1);
+  }
+  console.log(`\u2713 Cognito invite template guard: every invite_message_template block is complete`);
+}
+
+// src/scripts/check-core-direct-paths.ts
+import { join as join38 } from "path";
+import { execa as execa8 } from "execa";
+
+// src/lib/core-direct-paths-audit.ts
+import { readFileSync as readFileSync28, readdirSync as readdirSync15, statSync as statSync8 } from "fs";
+import { join as join37 } from "path";
 var EXTERNAL_BASE_IDENTIFIERS = ["CORE_API_URL"];
 var API_ROUTE_PREFIX = "/api/v1";
 var TEST_FILE_SUFFIXES = [".test.ts", ".test.tsx", ".spec.ts", ".spec.tsx"];
@@ -10034,30 +10163,30 @@ function countRawExternalOccurrences(rawText, externalBases = EXTERNAL_BASE_IDEN
 }
 function walkFiles(root, accept, skipDir) {
   const out = [];
-  const walk = (dir) => {
+  const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync14(dir);
+      entries = readdirSync15(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join36(dir, entry);
+      const p = join37(dir, entry);
       let st;
       try {
-        st = statSync7(p);
+        st = statSync8(p);
       } catch {
         continue;
       }
       if (st.isDirectory()) {
         if (skipDir(entry)) continue;
-        walk(p);
+        walk2(p);
         continue;
       }
       if (accept(entry)) out.push(p);
     }
   };
-  walk(root);
+  walk2(root);
   return out.sort();
 }
 function frontendSourceFiles(frontendSrcDir) {
@@ -10072,7 +10201,7 @@ function auditFrontendExtraction(frontendSrcDir, externalBases = EXTERNAL_BASE_I
   const extracted = [];
   let rawTotal = 0;
   for (const file of files) {
-    const text = readFileSync27(file, "utf8");
+    const text = readFileSync28(file, "utf8");
     rawTotal += countRawExternalOccurrences(text, externalBases);
     extracted.push(...extractCoreDirectPaths(text, file, externalBases));
   }
@@ -10121,7 +10250,7 @@ function auditCoreRouteExtraction(apiSrcDir) {
   const prefixSet = /* @__PURE__ */ new Set();
   let rawApiRouterCount = 0;
   for (const file of files) {
-    const text = readFileSync27(file, "utf8");
+    const text = readFileSync28(file, "utf8");
     const extraction = extractCoreRoutePrefixes(text);
     rawApiRouterCount += extraction.rawApiRouterCount;
     for (const p of extraction.prefixes) prefixSet.add(normalizePrefix(p));
@@ -10169,10 +10298,10 @@ function auditSiblingCoreDirectPaths(params) {
 
 // src/scripts/check-core-direct-paths.ts
 async function runCoreDirectPathsCheck(opts = {}) {
-  const root = (await execa7("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const sibling = opts.sibling ?? "sibling-template (self-check)";
-  const frontendSrcDir = opts.frontendSrc ?? join37(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
-  const coreApiSrcDir = opts.coreSrc ?? join37(root, "services", "api", "src");
+  const frontendSrcDir = opts.frontendSrc ?? join38(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
+  const coreApiSrcDir = opts.coreSrc ?? join38(root, "services", "api", "src");
   const report = auditSiblingCoreDirectPaths({ sibling, frontendSrcDir, coreApiSrcDir });
   console.log(
     `audited ${report.extractedCount} core-direct call site(s) across ${report.frontendFiles} frontend file(s) under ${frontendSrcDir}, against ${report.corePrefixCount} route prefix(es) from ${report.coreFiles} core file(s) under ${coreApiSrcDir}`
@@ -10207,7 +10336,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
 }
 
 // src/scripts/check-core-ownership.ts
-import { execa as execa8 } from "execa";
+import { execa as execa9 } from "execa";
 var BOLD = "\x1B[1m";
 var DIM = "\x1B[2m";
 var RED = "\x1B[31m";
@@ -10218,7 +10347,7 @@ async function runOwnershipCheck(argv) {
   const stagedFlag = args.indexOf("--staged");
   const staged = stagedFlag !== -1;
   const messageFile = staged ? args[stagedFlag + 1] : void 0;
-  const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const ownership = classifyRepoOwnership(root);
   if (ownership === "template") {
     console.log("\u2713 core ownership guard: skipped \u2014 this is the template, which owns these paths.");
@@ -10234,11 +10363,11 @@ async function runOwnershipCheck(argv) {
   let deletedFiles = [];
   let commitMessage = "";
   if (staged) {
-    const { stdout } = await execa8("git", ["diff", "--cached", "--name-status"], { cwd: root });
+    const { stdout } = await execa9("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync32, existsSync: existsSync43 } = await import("fs");
-      if (existsSync43(messageFile)) commitMessage = readFileSync32(messageFile, "utf8");
+      const { readFileSync: readFileSync37, existsSync: existsSync44 } = await import("fs");
+      if (existsSync44(messageFile)) commitMessage = readFileSync37(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -10246,18 +10375,18 @@ async function runOwnershipCheck(argv) {
       console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
       process.exit(2);
     }
-    await execa8("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-    const { stdout } = await execa8("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
+    await execa9("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+    const { stdout } = await execa9("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
       cwd: root
     });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
-    const { stdout: log2 } = await execa8("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
+    const { stdout: log2 } = await execa9("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
       cwd: root,
       reject: false
     });
     commitMessage = log2;
   }
-  const { stdout: gitBranch } = await execa8("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+  const { stdout: gitBranch } = await execa9("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
     cwd: root,
     reject: false
   });
@@ -10339,11 +10468,11 @@ ${BOLD}If the divergence is deliberate${OFF}
 }
 
 // src/scripts/check-eventbridge-log-permissions.ts
-import { execa as execa9 } from "execa";
+import { execa as execa10 } from "execa";
 
 // src/lib/eventbridge-log-permission-guard.ts
-import { readFileSync as readFileSync28, readdirSync as readdirSync15, statSync as statSync8 } from "fs";
-import { join as join38 } from "path";
+import { readFileSync as readFileSync29, readdirSync as readdirSync16, statSync as statSync9 } from "fs";
+import { join as join39 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
 var LOG_RESOURCE_POLICY_TYPE = "aws_cloudwatch_log_resource_policy";
@@ -10412,30 +10541,30 @@ function countRawResourceDeclarations(text, resourceType) {
 }
 function walkTerraformFiles(root) {
   const out = [];
-  const walk = (dir) => {
+  const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync15(dir);
+      entries = readdirSync16(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join38(dir, entry);
+      const p = join39(dir, entry);
       let st;
       try {
-        st = statSync8(p);
+        st = statSync9(p);
       } catch {
         continue;
       }
       if (st.isDirectory()) {
         if (SKIP_DIRS.has(entry)) continue;
-        walk(p);
+        walk2(p);
         continue;
       }
       if (entry.endsWith(".tf")) out.push(p);
     }
   };
-  walk(root);
+  walk2(root);
   return out.sort();
 }
 function resolveEventTargetLogGroup(body) {
@@ -10463,7 +10592,7 @@ function auditEventBridgeLogPermissions(root) {
   let rawEventTargetCount = 0;
   let rawLogPolicyCount = 0;
   for (const file of files) {
-    const text = readFileSync28(file, "utf8");
+    const text = readFileSync29(file, "utf8");
     rawEventTargetCount += countRawResourceDeclarations(text, EVENT_TARGET_TYPE);
     rawLogPolicyCount += countRawResourceDeclarations(text, LOG_RESOURCE_POLICY_TYPE);
     eventTargetBlocks.push(...findResourceBlocks(text, file, EVENT_TARGET_TYPE));
@@ -10516,7 +10645,7 @@ function auditEventBridgeLogPermissions(root) {
 
 // src/scripts/check-eventbridge-log-permissions.ts
 async function runEventBridgeLogPermissionCheck() {
-  const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let report;
   try {
     report = auditEventBridgeLogPermissions(root);
@@ -10552,35 +10681,338 @@ async function runEventBridgeLogPermissionCheck() {
   console.log(`\u2713 EventBridge log permission guard: ${report.summary}`);
 }
 
+// src/scripts/check-lambda-output.ts
+import { execa as execa11 } from "execa";
+
+// src/lib/lambda-output-guard.ts
+import { readFileSync as readFileSync31 } from "fs";
+import { join as join41 } from "path";
+
+// src/lib/terraform-input-guard.ts
+import { readdirSync as readdirSync17, readFileSync as readFileSync30, statSync as statSync10 } from "fs";
+import { join as join40 } from "path";
+var GUARDED_SUBCOMMANDS = [
+  "init",
+  "plan",
+  "apply",
+  "destroy",
+  "import",
+  "refresh"
+];
+var IGNORED_SUBCOMMANDS = ["output", "state", "fmt", "validate", "version", "workspace", "show"];
+function stripComments2(source) {
+  return source.split("\n").map((line) => line.replace(/(^|\s)#.*$/, "$1")).join("\n");
+}
+function findWorkflowFiles(repoRoot) {
+  const found = [];
+  const walk2 = (dir, relative8) => {
+    let entries;
+    try {
+      entries = readdirSync17(dir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
+      const full = join40(dir, entry);
+      const rel = relative8 ? `${relative8}/${entry}` : entry;
+      if (statSync10(full).isDirectory()) {
+        walk2(full, rel);
+      } else if (/\.ya?ml$/.test(entry) && relative8.endsWith(".github/workflows")) {
+        found.push(rel);
+      }
+    }
+  };
+  walk2(repoRoot, "");
+  return found.sort();
+}
+function checkWorkflowSource(file, rawSource) {
+  const violations = [];
+  const source = stripComments2(rawSource);
+  const lines = source.split("\n");
+  let sawGuardedInvocation = false;
+  lines.forEach((line, index) => {
+    const match = /(?:^|[\s;&|(])terraform\s+([a-z-]+)/.exec(line);
+    if (!match) return;
+    const subcommand = match[1];
+    if (subcommand === void 0) return;
+    if (IGNORED_SUBCOMMANDS.includes(subcommand)) return;
+    if (!GUARDED_SUBCOMMANDS.includes(subcommand)) return;
+    sawGuardedInvocation = true;
+    if (!/-input=false/.test(line)) {
+      violations.push({
+        file,
+        line: index + 1,
+        message: `terraform ${subcommand} is missing -input=false. Without it Terraform prompts on stdin for any unresolved variable and blocks forever in CI (issue #322). Note -auto-approve does not suppress variable prompts.`
+      });
+    }
+  });
+  if (sawGuardedInvocation && !/^\s*TF_INPUT\s*:/m.test(source)) {
+    violations.push({
+      file,
+      line: 1,
+      message: `workflow runs Terraform but does not set TF_INPUT. Add "TF_INPUT: '0'" to the workflow-level env block as a backstop (issue #322).`
+    });
+  }
+  return violations;
+}
+function checkTerraformInput(repoRoot) {
+  return findWorkflowFiles(repoRoot).flatMap(
+    (file) => checkWorkflowSource(file, readFileSync30(join40(repoRoot, file), "utf8"))
+  );
+}
+
+// src/lib/lambda-output-guard.ts
+var GUARDED_LAMBDA_SUBCOMMANDS = [
+  "update-function-code",
+  "update-function-configuration"
+];
+function joinContinuations(source) {
+  const rawLines = source.split("\n");
+  const logical = [];
+  let buffer = "";
+  let start = 0;
+  rawLines.forEach((raw, index) => {
+    const lineNo = index + 1;
+    const trimmedEnd = raw.replace(/\s+$/, "");
+    const continues = trimmedEnd.endsWith("\\");
+    const piece = continues ? trimmedEnd.slice(0, -1) : trimmedEnd;
+    if (buffer === "") start = lineNo;
+    buffer = buffer === "" ? piece : `${buffer} ${piece.replace(/^\s+/, "")}`;
+    if (!continues) {
+      logical.push({ text: buffer, startLine: start });
+      buffer = "";
+    }
+  });
+  if (buffer !== "") logical.push({ text: buffer, startLine: start });
+  return logical;
+}
+function isOutputSuppressed(command) {
+  if (/>\s*\/dev\/null/.test(command)) return true;
+  const hasTextOutput = /--output\s+text\b/.test(command);
+  const queryMatch = /--query\s+(['"]?)([^\s'"]+)\1/.exec(command);
+  if (hasTextOutput && queryMatch) {
+    const projection = queryMatch[2] ?? "";
+    if (!/environment/i.test(projection)) return true;
+  }
+  return false;
+}
+function checkWorkflowSource2(file, rawSource) {
+  const violations = [];
+  const source = stripComments2(rawSource);
+  for (const { text, startLine } of joinContinuations(source)) {
+    for (const subcommand of GUARDED_LAMBDA_SUBCOMMANDS) {
+      const invocation = new RegExp(`(?:^|[\\s;&|(])aws\\s+lambda\\s+${subcommand}\\b`);
+      if (!invocation.test(text)) continue;
+      if (isOutputSuppressed(text)) continue;
+      violations.push({
+        file,
+        line: startLine,
+        message: `aws lambda ${subcommand} does not suppress its output. Its default is the full function configuration as JSON \u2014 Environment.Variables in plaintext \u2014 which leaks DB credentials into the Actions log (#334). Add --output text --query 'LastUpdateStatus' (or redirect to /dev/null).`
+      });
+    }
+  }
+  return violations;
+}
+function checkLambdaOutput(repoRoot) {
+  return findWorkflowFiles(repoRoot).flatMap(
+    (file) => checkWorkflowSource2(file, readFileSync31(join41(repoRoot, file), "utf8"))
+  );
+}
+
+// src/scripts/check-lambda-output.ts
+async function runLambdaOutputCheck() {
+  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const files = findWorkflowFiles(root);
+  console.log(`audited ${files.length} workflow file(s) under ${root}`);
+  if (files.length === 0) {
+    console.error(
+      "\u2717 Lambda output guard: found 0 workflow files \u2014 this looks like a broken scan, not a clean repo. Refusing to report success over zero input."
+    );
+    process.exit(1);
+  }
+  const violations = checkLambdaOutput(root);
+  if (violations.length > 0) {
+    console.error("\u2717 Lambda output guard: unsuppressed aws lambda update-function-* output found\n");
+    for (const v of violations) {
+      console.error(`  ${v.file}:${v.line}  ${v.message}`);
+    }
+    console.error("\nSee biffo-template#334.");
+    process.exit(1);
+  }
+  console.log(`\u2713 Lambda output guard: every aws lambda update-function-* call suppresses output`);
+}
+
+// src/scripts/check-pipe-trap.ts
+import { readFileSync as readFileSync32, readdirSync as readdirSync18 } from "fs";
+import { join as join42, relative as relative6 } from "path";
+import { execa as execa12 } from "execa";
+
+// src/lib/pipe-trap-guard.ts
+var STATUS_BEARING = [
+  // Three-valued: 0 green, 1 failed, 2 cannot tell — and 2 is never a pass.
+  /\bwait-for-checks\b/,
+  /\bbranch-health\b/,
+  /\bclaim\.sh\b/,
+  /\bbiffo\.sh\s+(claim|wait-for-checks|branch-health|verify)\b/,
+  // Push rejection is how commits get silently lost (AGENTS.md §4).
+  /\bgit\s+push\b/,
+  /\bverify\.sh\b/
+];
+var QUERY_FLAGS = [/--list\b/, /--help\b/, /--version\b/];
+function strip(source) {
+  return source.split("\n").map((raw) => {
+    let out = "";
+    let quote = null;
+    for (let i = 0; i < raw.length; i++) {
+      const c = raw[i];
+      if (quote) {
+        if (c === "\\" && quote === '"') {
+          i++;
+          continue;
+        }
+        if (c === quote) {
+          quote = null;
+          continue;
+        }
+        if (c === "$" && quote === '"') {
+          out += c + (raw[i + 1] ?? "");
+          i++;
+        }
+        continue;
+      }
+      if (c === '"' || c === "'") {
+        quote = c;
+        continue;
+      }
+      if (c === "\\") {
+        i++;
+        continue;
+      }
+      if (c === "#" && (out === "" || /\s/.test(out[out.length - 1] ?? ""))) break;
+      out += c;
+    }
+    return out;
+  });
+}
+function isPipeline(line) {
+  for (let i = 0; i < line.length; i++) {
+    if (line[i] !== "|") continue;
+    if (line[i + 1] === "|") {
+      i++;
+      continue;
+    }
+    if (line[i - 1] === "|") continue;
+    return true;
+  }
+  return false;
+}
+function findPipeTraps(source) {
+  const lines = strip(source);
+  const traps = [];
+  let lastWasPipeline = false;
+  lines.forEach((line, index) => {
+    const trimmed = line.trim();
+    if (trimmed === "") return;
+    if (isPipeline(line)) {
+      const head = line.split("|")[0] ?? "";
+      const matched = STATUS_BEARING.find((p) => p.test(head));
+      const isQuery = QUERY_FLAGS.some((p) => p.test(head));
+      if (matched && !isQuery) {
+        traps.push({
+          line: index + 1,
+          text: trimmed,
+          reason: `a status-bearing command upstream of a pipe \u2014 the pipeline reports the LAST command's status, so this can only ever read 0`
+        });
+      }
+    }
+    if (lastWasPipeline && /\$\?/.test(line)) {
+      traps.push({
+        line: index + 1,
+        text: trimmed,
+        reason: `$? read directly after a pipeline \u2014 that is the LAST command's status, not the one you meant. Use \${PIPESTATUS[0]}, or drop the pipe`
+      });
+    }
+    lastWasPipeline = isPipeline(line);
+  });
+  return traps;
+}
+
+// src/scripts/check-pipe-trap.ts
+function shellFiles(root) {
+  const out = [];
+  for (const dir of ["scripts", ".githooks"]) {
+    const full = join42(root, dir);
+    let entries;
+    try {
+      entries = readdirSync18(full, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isFile()) continue;
+      if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
+      out.push(join42(full, entry.name));
+    }
+  }
+  return out;
+}
+async function runPipeTrapCheck() {
+  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const files = shellFiles(root);
+  console.log(`audited ${files.length} shell file(s) under scripts/ and .githooks/ under ${root}`);
+  if (files.length === 0) {
+    console.error(
+      "\u2717 Pipe-trap guard: found 0 shell files under scripts/ or .githooks/ \u2014 this looks like a broken scan, not a clean repo. Refusing to report success over zero input."
+    );
+    process.exit(1);
+  }
+  const findings = files.flatMap(
+    (file) => findPipeTraps(readFileSync32(file, "utf8")).map(
+      (t) => `${relative6(root, file)}:${t.line}  ${t.text}
+    ${t.reason}`
+    )
+  );
+  if (findings.length > 0) {
+    console.error("\u2717 Pipe-trap guard: status-bearing pipeline(s) found\n");
+    for (const f of findings) {
+      console.error(`  ${f}`);
+    }
+    console.error("\nSee biffo-template#1231 (AGENTS.md \xA74).");
+    process.exit(1);
+  }
+  console.log(`\u2713 Pipe-trap guard: no status-bearing command is piped away`);
+}
+
 // src/scripts/check-plugin-collisions.ts
 import { existsSync as existsSync37 } from "fs";
-import { join as join40 } from "path";
-import { execa as execa10 } from "execa";
+import { join as join44 } from "path";
+import { execa as execa13 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync36, readdirSync as readdirSync16, statSync as statSync9 } from "fs";
-import { join as join39 } from "path";
+import { existsSync as existsSync36, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
+import { join as join43 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
   if (!existsSync36(dir)) return [];
-  return readdirSync16(dir).filter((entry) => {
+  return readdirSync19(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync9(join39(dir, entry)).isDirectory();
+      return statSync11(join43(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync36(join39(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync36(join43(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join39(pluginDir2, "tests");
+  const testsDir = join43(pluginDir2, "tests");
   if (!existsSync36(testsDir)) return [];
-  if (existsSync36(join39(testsDir, "__init__.py"))) return [];
-  return readdirSync16(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
+  if (existsSync36(join43(testsDir, "__init__.py"))) return [];
+  return readdirSync19(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
   const plugins = (pluginDirs ?? subdirectories(servicesDir)).filter((name) => !name.startsWith("_")).filter((name) => name !== "api").sort();
@@ -10588,7 +11020,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join39(servicesDir, plugin))) {
+      for (const name of namesOf(join43(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -10625,8 +11057,8 @@ function formatCollisions(collisions) {
 
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
-  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join40(root, "services");
+  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const servicesDir = join44(root, "services");
   if (!existsSync37(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
@@ -10644,38 +11076,38 @@ async function runPluginCollisionCheck() {
 }
 
 // src/scripts/check-plugin-terraform.ts
-import { execa as execa11 } from "execa";
+import { execa as execa14 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync38, readFileSync as readFileSync29, readdirSync as readdirSync17 } from "fs";
-import { dirname as dirname9, join as join41, relative as relative6, sep as sep3 } from "path";
+import { existsSync as existsSync38, readFileSync as readFileSync33, readdirSync as readdirSync20 } from "fs";
+import { dirname as dirname9, join as join45, relative as relative7, sep as sep3 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
   const found = [];
-  const walk = (dir) => {
+  const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync17(dir, { withFileTypes: true });
+      entries = readdirSync20(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS2.has(entry.name)) continue;
-        walk(join41(dir, entry.name));
+        walk2(join45(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative6(root, join41(dir, entry.name)).split(sep3).join("/"));
+        found.push(relative7(root, join45(dir, entry.name)).split(sep3).join("/"));
       }
     }
   };
-  walk(root);
+  walk2(root);
   return found.sort();
 }
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync29(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync33(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -10690,15 +11122,15 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync38(join41(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync38(join45(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join41(root, manifest);
+    const absManifest = join45(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname9(absManifest);
-    if (existsSync38(join41(pluginDir2, "terraform"))) continue;
-    const relPluginDir = relative6(root, pluginDir2).split(sep3).join("/");
+    if (existsSync38(join45(pluginDir2, "terraform"))) continue;
+    const relPluginDir = relative7(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
       expectedTerraformDir: relPluginDir ? `${relPluginDir}/terraform` : "terraform",
@@ -10717,7 +11149,7 @@ function formatViolations(violations) {
 
 // src/scripts/check-plugin-terraform.ts
 async function runPluginTerraformCheck() {
-  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const violations = checkPluginTerraform(root);
   if (violations.length > 0) {
     console.error("\u2717 plugin Terraform guard: event subscriptions with no infrastructure\n");
@@ -10729,12 +11161,12 @@ async function runPluginTerraformCheck() {
 
 // src/scripts/check-plugin-tool-supply.ts
 import { existsSync as existsSync40 } from "fs";
-import { join as join43 } from "path";
-import { execa as execa12 } from "execa";
+import { join as join47 } from "path";
+import { execa as execa15 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync39, readFileSync as readFileSync30, readdirSync as readdirSync18, statSync as statSync10 } from "fs";
-import { join as join42 } from "path";
+import { existsSync as existsSync39, readFileSync as readFileSync34, readdirSync as readdirSync21, statSync as statSync12 } from "fs";
+import { join as join46 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -11145,13 +11577,13 @@ var OPENROUTER_MODEL_IDS = [
 function listDirs(root) {
   let entries;
   try {
-    entries = readdirSync18(root);
+    entries = readdirSync21(root);
   } catch {
     return [];
   }
   return entries.filter((e) => {
     try {
-      return statSync10(join42(root, e)).isDirectory();
+      return statSync12(join46(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -11159,30 +11591,30 @@ function listDirs(root) {
 }
 function walkFiles2(root, accept, skipDir) {
   const out = [];
-  const walk = (dir) => {
+  const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync18(dir);
+      entries = readdirSync21(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join42(dir, entry);
+      const p = join46(dir, entry);
       let st;
       try {
-        st = statSync10(p);
+        st = statSync12(p);
       } catch {
         continue;
       }
       if (st.isDirectory()) {
         if (skipDir(entry)) continue;
-        walk(p);
+        walk2(p);
         continue;
       }
       if (accept(entry)) out.push(p);
     }
   };
-  walk(root);
+  walk2(root);
   return out.sort();
 }
 function pluginPythonFiles(pluginDir2) {
@@ -11193,14 +11625,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join42(pluginDir2, "terraform");
+  const tfDir = join46(pluginDir2, "terraform");
   let entries;
   try {
-    entries = readdirSync18(tfDir);
+    entries = readdirSync21(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join42(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join46(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -11452,8 +11884,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join42("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join42(
+var CONFIG_PY_PATH = join46("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join46(
   "services",
   "api",
   "src",
@@ -11465,8 +11897,8 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join42(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join42(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configPath = join46(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join46(repoRoot, ORCHESTRATION_SCHEMA_PATH);
   const configMissing = !existsSync39(configPath);
   const orchestrationSchemaMissing = !existsSync39(orchestrationPath);
   const knownSet = new Set(knownModelIds);
@@ -11486,13 +11918,13 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   };
   let settingsBlind = false;
   if (!configMissing) {
-    const settingsFields = extractSettingsModelFields(readFileSync30(configPath, "utf8"));
+    const settingsFields = extractSettingsModelFields(readFileSync34(configPath, "utf8"));
     if (settingsFields.length === 0) settingsBlind = true;
     for (const { field, value } of settingsFields) record(`${CONFIG_PY_PATH}#${field}`, value);
   }
   let curatedFieldsBlind = false;
   if (!orchestrationSchemaMissing) {
-    const curated = extractCuratedModelFields(readFileSync30(orchestrationPath, "utf8"));
+    const curated = extractCuratedModelFields(readFileSync34(orchestrationPath, "utf8"));
     if (curated.rawFieldCount > 0 && curated.fields.every((f) => f.defaultValue === null && f.optionValues.length === 0)) {
       curatedFieldsBlind = true;
     }
@@ -11539,7 +11971,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync10(join42(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync12(join46(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -11552,8 +11984,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join42(pluginsRoot, name);
-    const manifestText = readFileSync30(join42(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join46(pluginsRoot, name);
+    const manifestText = readFileSync34(join46(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -11571,13 +12003,13 @@ function auditPluginToolSupply(pluginsRoot) {
     totalDeclaredTools += manifest.tools.length;
     const pySources = pluginPythonFiles(pluginDir2).map((f) => ({
       file: f,
-      text: readFileSync30(f, "utf8")
+      text: readFileSync34(f, "utf8")
     }));
     const resolver = buildSymbolResolver(pySources);
     const registry = extractToolRegistryEntries(pySources, resolver);
     if (registry.rawToolDefinitionCount > 0 && registry.entries.length === 0) registryBlind = true;
     const tfFiles = pluginTerraformFiles(pluginDir2);
-    const tfText = tfFiles.map((f) => readFileSync30(f, "utf8")).join("\n");
+    const tfText = tfFiles.map((f) => readFileSync34(f, "utf8")).join("\n");
     const terraform = extractTerraformEnvKeys(tfText);
     if (terraform.rawMarkerCount > 0 && terraform.resolvedBlockCount === 0) terraformBlind = true;
     for (const toolName of manifest.tools) {
@@ -11651,7 +12083,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join42(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join46(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -11682,9 +12114,9 @@ function auditPluginToolSupply(pluginsRoot) {
 
 // src/scripts/check-plugin-tool-supply.ts
 async function runPluginToolSupplyCheck() {
-  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
-  const pluginsRoot = join43(root, "services", "_plugins");
+  const pluginsRoot = join47(root, "services", "_plugins");
   if (!existsSync40(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
@@ -11715,7 +12147,7 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join43(root, "services", "api");
+  const servicesApiRoot = join47(root, "services", "api");
   if (!existsSync40(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
@@ -11762,7 +12194,7 @@ async function runPluginToolSupplyCheck() {
 }
 
 // src/scripts/check-release-subject.ts
-import { execa as execa13 } from "execa";
+import { execa as execa16 } from "execa";
 
 // src/lib/release-version.ts
 var MINOR_TYPES = /* @__PURE__ */ new Set(["feat"]);
@@ -11799,7 +12231,7 @@ async function fetchPrTitleViaGh({
   PR_NUMBER,
   GH_REPO
 }) {
-  const { stdout } = await execa13(
+  const { stdout } = await execa16(
     "gh",
     ["pr", "view", PR_NUMBER, "--repo", GH_REPO, "--json", "title", "--jq", ".title"],
     { env: { ...process.env, GH_TOKEN } }
@@ -11835,7 +12267,7 @@ async function resolveReleaseSubject({
       );
     }
   }
-  return (await execa13("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
+  return (await execa16("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
 }
 async function runReleaseSubjectCheck(argv) {
   const base = process.env["GITHUB_BASE_REF"] ?? argv[0];
@@ -11843,9 +12275,9 @@ async function runReleaseSubjectCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  await execa13("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa13("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
+  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  await execa16("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa16("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
     cwd: root
   });
   const changedFiles = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -11892,9 +12324,196 @@ async function runReleaseSubjectCheck(argv) {
   );
 }
 
+// src/scripts/check-skeleton-drift.ts
+import { existsSync as existsSync41, readdirSync as readdirSync23 } from "fs";
+import { join as join49 } from "path";
+import { execa as execa17 } from "execa";
+
+// src/lib/skeleton-drift-guard.ts
+import { readFileSync as readFileSync35, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
+import { join as join48 } from "path";
+var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
+var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
+var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
+var executableLines = (contents) => contents.split("\n").filter((line) => !/^\s*#/.test(line));
+var UNHARDENED_AUDITS = [
+  { pattern: /\b(pnpm|npm|yarn)\s+audit\b/, replacement: "sh scripts/js-dependency-audit.sh" },
+  { pattern: /\bpip-audit\b/, replacement: "sh scripts/py-dependency-audit.sh" }
+];
+var SKELETON_RULES = [
+  {
+    id: "runner-label",
+    rationale: "A hardcoded `ubuntu-latest` bills GitHub-hosted minutes and fails immediately on an account over its spending limit, which is the state this project is in \u2014 so a generated repo cannot reach the self-hosted fleet at all (#651).",
+    appliesTo: isWorkflow,
+    check: (_rel, contents) => {
+      const hardcoded = [...contents.matchAll(/^\s*runs-on:\s*(.+)$/gm)].map((m) => m[1].trim()).filter((v) => !v.includes("RUNNER_LABEL"));
+      return hardcoded.length > 0 ? `${hardcoded.length} job(s) pin a runner directly instead of \`\${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}\`: ${[...new Set(hardcoded)].join(", ")}` : null;
+    }
+  },
+  {
+    id: "no-gitleaks-action",
+    rationale: "gitleaks/gitleaks-action@v2 cannot pass here for two independent reasons: its SARIF upload assumes a GitHub-hosted $HOME layout and dies on self-hosted runners, and it requires a paid licence for organization-owned repos. Every generated repo was born with a permanently red Secret Scan (#649).",
+    appliesTo: isWorkflow,
+    check: (_rel, contents) => /^\s*(-\s*)?uses:\s*gitleaks\/gitleaks-action/m.test(contents) ? "uses gitleaks/gitleaks-action; install the free CLI directly, as the root ci.yml does" : null
+  },
+  {
+    id: "hardened-dependency-audit",
+    rationale: "A raw `pnpm audit --audit-level=high` or `uv run pip-audit` exits non-zero identically whether it found a vulnerability or simply could not parse the registry's response, so one npm/PyPI hiccup reds a required check on every open PR at once \u2014 for an infrastructure blip with nothing to do with the code (#591). This repo hardened its own audits in #592/#636/#717/#721 and went on shipping the raw commands into every generated repo for months, so six siblings and two plugin repos were born with the original defect (#743). The wrappers parse the output first: they fail only on a genuine finding, retry a transient error, and report INCONCLUSIVE loudly rather than passing or failing blind.",
+    appliesTo: isWorkflow,
+    check: (_rel, contents) => {
+      const offenders = executableLines(contents).filter(
+        (line) => UNHARDENED_AUDITS.some((a) => a.pattern.test(line))
+      );
+      if (offenders.length === 0) return null;
+      const wanted = [
+        ...new Set(
+          UNHARDENED_AUDITS.filter((a) => offenders.some((line) => a.pattern.test(line))).map(
+            (a) => a.replacement
+          )
+        )
+      ];
+      return `${offenders.length} step(s) run an unhardened dependency audit directly: ${offenders.map((l) => l.trim()).join(" | ")}. Call ${wanted.join(" / ")} instead.`;
+    }
+  },
+  {
+    id: "derived-app-title",
+    rationale: "A root layout that hard-codes `metadata.title` ships that literal as every generated repo's browser title, and nothing at scaffold time ever touches it. The sibling skeleton carried `title: 'Sibling App'` for its whole life, so two of tabsii's five siblings were still serving it in their deployed out/index.html \u2014 visible to users, not just in source (#963). Derive it from the build-time `NEXT_PUBLIC_SIBLING_NAME` instead (see the skeleton's own `src/lib/branding.ts`), the way the portal derives `PORTAL_TITLE` (#389).",
+    appliesTo: isRootLayout,
+    check: (_rel, contents) => {
+      const match = /\btitle:\s*(['"`])([^'"`]*)\1/.exec(uncommented(contents));
+      return match ? `metadata.title is the hard-coded literal ${match[1]}${match[2]}${match[1]}; derive it from the generated app\u2019s own name instead` : null;
+    }
+  }
+];
+function walk(dir, base = dir) {
+  const out = [];
+  let entries;
+  try {
+    entries = readdirSync22(dir);
+  } catch {
+    return out;
+  }
+  for (const entry of entries) {
+    if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
+    const abs = join48(dir, entry);
+    let isDir;
+    try {
+      isDir = statSync13(abs).isDirectory();
+    } catch {
+      continue;
+    }
+    if (isDir) out.push(...walk(abs, base));
+    else
+      out.push(
+        abs.slice(base.length + 1).split("\\").join("/")
+      );
+  }
+  return out;
+}
+function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
+  const violations = [];
+  for (const rel of walk(skeletonRoot)) {
+    for (const rule of rules) {
+      if (!rule.appliesTo(rel)) continue;
+      let contents;
+      try {
+        contents = readFileSync35(join48(skeletonRoot, rel), "utf8");
+      } catch {
+        continue;
+      }
+      const detail = rule.check(rel, contents);
+      if (detail !== null) {
+        violations.push({ skeleton: name, file: rel, rule: rule.id, detail });
+      }
+    }
+  }
+  return violations;
+}
+function formatViolations2(violations) {
+  const byRule = /* @__PURE__ */ new Map();
+  for (const v of violations) {
+    byRule.set(v.rule, [...byRule.get(v.rule) ?? [], v]);
+  }
+  const lines = [];
+  for (const [ruleId, group] of byRule) {
+    const rule = SKELETON_RULES.find((r) => r.id === ruleId);
+    lines.push(`  ${ruleId}:`);
+    for (const v of group) lines.push(`    ${v.skeleton}/${v.file} \u2014 ${v.detail}`);
+    if (rule) lines.push(`    why: ${rule.rationale}`);
+  }
+  return lines.join("\n");
+}
+
+// src/scripts/check-skeleton-drift.ts
+function discoverSkeletons(root) {
+  const skeletonsDir = join49(root, "_skeletons");
+  let entries;
+  try {
+    entries = readdirSync23(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+  return entries.filter((name) => existsSync41(join49(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+}
+async function runSkeletonDriftCheck() {
+  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const skeletons = discoverSkeletons(root);
+  let filesConsidered = 0;
+  for (const name of skeletons) {
+    const skeletonRoot = join49(root, "_skeletons", name);
+    filesConsidered += findWorkflowFiles(skeletonRoot).length;
+    if (existsSync41(join49(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+      filesConsidered += 1;
+    }
+  }
+  console.log(
+    `audited ${skeletons.length} skeleton(s) (${skeletons.join(", ") || "none"}), ${filesConsidered} file(s) considered, under ${root}/_skeletons`
+  );
+  if (skeletons.length === 0) {
+    console.error(
+      "\u2717 Skeleton-drift guard: found 0 repo skeletons under _skeletons/ \u2014 this looks like a broken scan, not a repo with no scaffolding. Refusing to report success over zero input."
+    );
+    process.exit(1);
+  }
+  const violations = skeletons.flatMap(
+    (name) => auditSkeleton(join49(root, "_skeletons", name), name)
+  );
+  if (violations.length > 0) {
+    console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
+    console.error(formatViolations2(violations));
+    console.error("\nSee skeleton-drift-guard.ts for why each rule exists.");
+    process.exit(1);
+  }
+  console.log(`\u2713 Skeleton-drift guard: every skeleton holds every rule`);
+}
+
+// src/scripts/check-terraform-input.ts
+import { execa as execa18 } from "execa";
+async function runTerraformInputCheck() {
+  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const files = findWorkflowFiles(root);
+  console.log(`audited ${files.length} workflow file(s) under ${root}`);
+  if (files.length === 0) {
+    console.error(
+      "\u2717 Terraform-input guard: found 0 workflow files \u2014 this looks like a broken scan, not a clean repo. Refusing to report success over zero input."
+    );
+    process.exit(1);
+  }
+  const violations = checkTerraformInput(root);
+  if (violations.length > 0) {
+    console.error("\u2717 Terraform-input guard: interactive Terraform invocation(s) found\n");
+    for (const v of violations) {
+      console.error(`  ${v.file}:${v.line}  ${v.message}`);
+    }
+    console.error("\nSee biffo-template#322.");
+    process.exit(1);
+  }
+  console.log(`\u2713 Terraform-input guard: every Terraform invocation is non-interactive`);
+}
+
 // src/commands/check.ts
 var checkCommand = new Command23("check").description(
-  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths) run in CI and git hooks, plus out-of-band audits (branch protection)"
+  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, cognito-invite-template, lambda-output, pipe-trap, skeleton-drift, terraform-input) run in CI and git hooks, plus out-of-band audits (branch protection)"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
   await runOwnershipCheck(rawArgsAfter("ownership"));
@@ -11928,6 +12547,31 @@ checkCommand.command("core-direct-paths").description(
 ).option("--sibling <name>", "Label for the report").option("--frontend-src <dir>", "Sibling's frontend source directory to scan").option("--core-src <dir>", "Core API's source directory (ground truth for route prefixes)").action(async (opts) => {
   await runCoreDirectPathsCheck(opts);
 });
+checkCommand.command("cognito-invite-template").description(
+  "Refuse a Cognito invite_message_template missing a required member or placeholder (#356) \u2014 terraform validate is silent on this, so a fresh deploy fails on its first apply"
+).action(async () => {
+  await runCognitoInviteTemplateCheck();
+});
+checkCommand.command("lambda-output").description(
+  "Refuse an unsuppressed aws lambda update-function-* call (#334) \u2014 its default output is the full function configuration, env vars in plaintext, leaked into the Actions log"
+).action(async () => {
+  await runLambdaOutputCheck();
+});
+checkCommand.command("pipe-trap").description(
+  "Refuse a status-bearing command (claim.sh, wait-for-checks, git push, ...) piped into another, or $? read after one (#1231) \u2014 both read the LAST command's exit status"
+).action(async () => {
+  await runPipeTrapCheck();
+});
+checkCommand.command("skeleton-drift").description(
+  "Refuse a fix this repo made for itself that never reached _skeletons/ \u2014 a hardcoded runner, the paid gitleaks action, an unhardened dependency audit, a hard-coded app title"
+).action(async () => {
+  await runSkeletonDriftCheck();
+});
+checkCommand.command("terraform-input").description(
+  "Refuse a Terraform invocation that can prompt on stdin without -input=false, or a workflow running Terraform without TF_INPUT set (#322) \u2014 a runner has no stdin to answer"
+).action(async () => {
+  await runTerraformInputCheck();
+});
 checkCommand.command("branch-protection").description(
   "Verify dev/staging/main are actually protected \u2014 scaffolding skips this on a 403 (#715)"
 ).option("--repo <owner/name>", "Repo to audit; defaults to this checkout's origin remote").option(
@@ -11942,8 +12586,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync41, readFileSync as readFileSync31 } from "fs";
-import { join as join44, resolve as resolve18 } from "path";
+import { existsSync as existsSync42, readFileSync as readFileSync36 } from "fs";
+import { join as join50, resolve as resolve18 } from "path";
 import chalk21 from "chalk";
 import { Command as Command24 } from "commander";
 
@@ -12118,10 +12762,10 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
   return runDoctorChecks(facts);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join44(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync41(path)) return null;
+  const path = join50(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync42(path)) return null;
   try {
-    return parseCoreRecord(readFileSync31(path, "utf8"));
+    return parseCoreRecord(readFileSync36(path, "utf8"));
   } catch {
     return null;
   }
@@ -12136,10 +12780,10 @@ function parseCoreRecord(contents) {
   }
 }
 function readFossil(cwd) {
-  const path = join44(cwd, CORE_VERSION_FILE);
-  if (!existsSync41(path)) return null;
+  const path = join50(cwd, CORE_VERSION_FILE);
+  if (!existsSync42(path)) return null;
   try {
-    const value = readFileSync31(path, "utf8").trim();
+    const value = readFileSync36(path, "utf8").trim();
     return value === "" ? null : value;
   } catch {
     return null;
@@ -12588,13 +13232,13 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command26 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync42 } from "fs";
-import { dirname as dirname10, join as join45 } from "path";
+import { existsSync as existsSync43 } from "fs";
+import { dirname as dirname10, join as join51 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join45(dir, relativePath);
-    if (existsSync42(candidate)) return candidate;
+    const candidate = join51(dir, relativePath);
+    if (existsSync43(candidate)) return candidate;
     const parent = dirname10(dir);
     if (parent === dir) return null;
     dir = parent;