@biffo/cli 0.267.4 → 0.267.6

package/_skeletons/plugin-template/services/api/tests/test_frontend_bff_paths.py

@@ -0,0 +1,26 @@
+"""Inert placeholder — see `_skeletons/sibling-template`'s copy for the real guard.
+
+biffo-template#1330. `shared-files.json`'s `filesFromSkeleton` parity check
+(`cli/src/lib/shared-files-parity.test.ts`) requires every entry to exist in
+every skeleton the marker table can select, so a missing copy can never be a
+silent empty-copy hazard — the same reasoning already applied to
+`.prettierrc`/`.prettierignore` for #1343, where a plugin repo carries an
+inert copy of a file it has no functional use for.
+
+This guard has no meaning for a plugin repo. The real file asserts that every
+literal `/api/v1/...` call a sibling app's frontend makes resolves to a route
+that app's own BFF (`services/api`) registers, reading both halves from
+`api.main.app` and `apps/frontend/src/**` — a plugin repo has neither of
+those trees: it mounts into a host application rather than owning a
+frontend-to-BFF seam of its own.
+
+Deliberately NOT the real file's content. The real guard imports `fastapi`
+and `starlette` and does `from api.main import app`; none of those are a
+dependency or a module this skeleton ships, so a verbatim copy would fail
+`pyright` (which walks the whole tree, `[tool.pyright]` in `pyproject.toml`
+carries no exclude for this path) on every plugin repo scaffolded from it.
+`pytest` is not at risk either way — `[tool.pytest.ini_options]`'s
+`testpaths = ["tests"]` already excludes this directory from collection — but
+`pyright` and `ruff check .` are not scoped the same way, so this stub has to
+be syntactically inert on its own: no imports, no names, nothing to check.
+"""

package/dist/index.js

@@ -10006,7 +10006,7 @@ import { join as join38 } from "path";
 import { execa as execa8 } from "execa";
 
 // src/lib/core-direct-paths-audit.ts
-import { readFileSync as readFileSync28, readdirSync as readdirSync15, statSync as statSync8 } from "fs";
+import { existsSync as existsSync36, readFileSync as readFileSync28, readdirSync as readdirSync15, statSync as statSync8 } from "fs";
 import { join as join37 } from "path";
 var EXTERNAL_BASE_IDENTIFIERS = ["CORE_API_URL"];
 var API_ROUTE_PREFIX = "/api/v1";
@@ -10264,6 +10264,39 @@ function pathMatchesAnyCorePrefix(normalized, corePrefixes, apiRoutePrefix = API
   }
   return false;
 }
+function resolveSiblingCoreSrc(params) {
+  const { estateDir, sibling } = params;
+  const configPath = join37(estateDir, sibling, "biffo.sibling.json");
+  let raw;
+  try {
+    raw = readFileSync28(configPath, "utf8");
+  } catch (err) {
+    throw new Error(
+      `cannot resolve ${sibling}'s core: ${configPath} does not exist or is unreadable (${err.message}) -- refusing to guess which core serves this sibling.`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `cannot resolve ${sibling}'s core: ${configPath} is not valid JSON (${err.message}).`
+    );
+  }
+  const coreProject = parsed !== null && typeof parsed === "object" && "core_project" in parsed ? parsed.core_project : void 0;
+  if (typeof coreProject !== "string" || coreProject.trim() === "") {
+    throw new Error(
+      `cannot resolve ${sibling}'s core: ${configPath} has no non-empty "core_project" field.`
+    );
+  }
+  const coreApiSrcDir = join37(estateDir, coreProject, "services", "api", "src");
+  if (!existsSync36(coreApiSrcDir)) {
+    throw new Error(
+      `cannot resolve ${sibling}'s core: biffo.sibling.json names core_project "${coreProject}", but ${coreApiSrcDir} does not exist -- the instance is missing from this estate checkout, not merely unmatched. Refusing to silently skip ${sibling} and shrink the audit's denominator.`
+    );
+  }
+  return { sibling, coreProject, coreApiSrcDir };
+}
 function auditSiblingCoreDirectPaths(params) {
   const externalBases = params.externalBases ?? EXTERNAL_BASE_IDENTIFIERS;
   const frontend = auditFrontendExtraction(params.frontendSrcDir, externalBases);
@@ -10301,10 +10334,26 @@ async function runCoreDirectPathsCheck(opts = {}) {
   const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const sibling = opts.sibling ?? "sibling-template (self-check)";
   const frontendSrcDir = opts.frontendSrc ?? join38(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
-  const coreApiSrcDir = opts.coreSrc ?? join38(root, "services", "api", "src");
+  let coreApiSrcDir;
+  let coreProject = null;
+  if (opts.coreSrc) {
+    coreApiSrcDir = opts.coreSrc;
+  } else if (opts.sibling && opts.estate) {
+    let resolution;
+    try {
+      resolution = resolveSiblingCoreSrc({ estateDir: opts.estate, sibling: opts.sibling });
+    } catch (err) {
+      console.error(`\u2717 core-direct-paths guard (${sibling}): ${err.message}`);
+      process.exit(1);
+    }
+    coreApiSrcDir = resolution.coreApiSrcDir;
+    coreProject = resolution.coreProject;
+  } else {
+    coreApiSrcDir = join38(root, "services", "api", "src");
+  }
   const report = auditSiblingCoreDirectPaths({ sibling, frontendSrcDir, coreApiSrcDir });
   console.log(
-    `audited ${report.extractedCount} core-direct call site(s) across ${report.frontendFiles} frontend file(s) under ${frontendSrcDir}, against ${report.corePrefixCount} route prefix(es) from ${report.coreFiles} core file(s) under ${coreApiSrcDir}`
+    `audited ${report.extractedCount} core-direct call site(s) across ${report.frontendFiles} frontend file(s) under ${frontendSrcDir}, against ${report.corePrefixCount} route prefix(es) from ${report.coreFiles} core file(s) under ${coreApiSrcDir}` + (coreProject ? ` (core project: ${coreProject})` : "")
   );
   if (!report.ok) {
     console.error(`\u2717 core-direct-paths guard (${sibling}): unmatched or unresolved call site(s)
@@ -10366,8 +10415,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa9("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync37, existsSync: existsSync44 } = await import("fs");
-      if (existsSync44(messageFile)) commitMessage = readFileSync37(messageFile, "utf8");
+      const { readFileSync: readFileSync37, existsSync: existsSync45 } = await import("fs");
+      if (existsSync45(messageFile)) commitMessage = readFileSync37(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -10985,17 +11034,17 @@ async function runPipeTrapCheck() {
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync37 } from "fs";
+import { existsSync as existsSync38 } from "fs";
 import { join as join44 } from "path";
 import { execa as execa13 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync36, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
+import { existsSync as existsSync37, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
 import { join as join43 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync36(dir)) return [];
+  if (!existsSync37(dir)) return [];
   return readdirSync19(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
@@ -11006,12 +11055,12 @@ function subdirectories(dir) {
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync36(join43(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync37(join43(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
   const testsDir = join43(pluginDir2, "tests");
-  if (!existsSync36(testsDir)) return [];
-  if (existsSync36(join43(testsDir, "__init__.py"))) return [];
+  if (!existsSync37(testsDir)) return [];
+  if (existsSync37(join43(testsDir, "__init__.py"))) return [];
   return readdirSync19(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
@@ -11059,7 +11108,7 @@ function formatCollisions(collisions) {
 async function runPluginCollisionCheck() {
   const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const servicesDir = join44(root, "services");
-  if (!existsSync37(servicesDir)) {
+  if (!existsSync38(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -11079,7 +11128,7 @@ async function runPluginCollisionCheck() {
 import { execa as execa14 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync38, readFileSync as readFileSync33, readdirSync as readdirSync20 } from "fs";
+import { existsSync as existsSync39, readFileSync as readFileSync33, readdirSync as readdirSync20 } from "fs";
 import { dirname as dirname9, join as join45, relative as relative7, sep as sep3 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
@@ -11122,14 +11171,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync38(join45(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync39(join45(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
     const absManifest = join45(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname9(absManifest);
-    if (existsSync38(join45(pluginDir2, "terraform"))) continue;
+    if (existsSync39(join45(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative7(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
@@ -11160,12 +11209,12 @@ async function runPluginTerraformCheck() {
 }
 
 // src/scripts/check-plugin-tool-supply.ts
-import { existsSync as existsSync40 } from "fs";
+import { existsSync as existsSync41 } from "fs";
 import { join as join47 } from "path";
 import { execa as execa15 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync39, readFileSync as readFileSync34, readdirSync as readdirSync21, statSync as statSync12 } from "fs";
+import { existsSync as existsSync40, readFileSync as readFileSync34, readdirSync as readdirSync21, statSync as statSync12 } from "fs";
 import { join as join46 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
@@ -11899,8 +11948,8 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const now = options.now ?? /* @__PURE__ */ new Date();
   const configPath = join46(repoRoot, CONFIG_PY_PATH);
   const orchestrationPath = join46(repoRoot, ORCHESTRATION_SCHEMA_PATH);
-  const configMissing = !existsSync39(configPath);
-  const orchestrationSchemaMissing = !existsSync39(orchestrationPath);
+  const configMissing = !existsSync40(configPath);
+  const orchestrationSchemaMissing = !existsSync40(orchestrationPath);
   const knownSet = new Set(knownModelIds);
   const snapshotEmpty = knownModelIds.length === 0;
   const snapshotStale = isSnapshotStale(snapshotFetchedAt, now);
@@ -12117,7 +12166,7 @@ async function runPluginToolSupplyCheck() {
   const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
   const pluginsRoot = join47(root, "services", "_plugins");
-  if (!existsSync40(pluginsRoot)) {
+  if (!existsSync41(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
     const report = auditPluginToolSupply(pluginsRoot);
@@ -12148,7 +12197,7 @@ async function runPluginToolSupplyCheck() {
     }
   }
   const servicesApiRoot = join47(root, "services", "api");
-  if (!existsSync40(servicesApiRoot)) {
+  if (!existsSync41(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
     const modelReport = auditDeclaredModelIds(root);
@@ -12325,7 +12374,7 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync41, readdirSync as readdirSync23 } from "fs";
+import { existsSync as existsSync42, readdirSync as readdirSync23 } from "fs";
 import { join as join49 } from "path";
 import { execa as execa17 } from "execa";
 
@@ -12453,7 +12502,7 @@ function discoverSkeletons(root) {
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync41(join49(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync42(join49(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
   const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
@@ -12462,7 +12511,7 @@ async function runSkeletonDriftCheck() {
   for (const name of skeletons) {
     const skeletonRoot = join49(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync41(join49(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync42(join49(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -12543,10 +12592,18 @@ checkCommand.command("plugin-tool-supply").description(
   await runPluginToolSupplyCheck();
 });
 checkCommand.command("core-direct-paths").description(
-  "Refuse a frontend's core-direct call site (bypassing its own BFF) naming a route prefix core does not register (#1377). Defaults to a self-check of the sibling skeleton against this repo's own services/api/src; --sibling/--frontend-src/--core-src point it at a real checked-out sibling instead"
-).option("--sibling <name>", "Label for the report").option("--frontend-src <dir>", "Sibling's frontend source directory to scan").option("--core-src <dir>", "Core API's source directory (ground truth for route prefixes)").action(async (opts) => {
-  await runCoreDirectPathsCheck(opts);
-});
+  "Refuse a frontend's core-direct call site (bypassing its own BFF) naming a route prefix core does not register (#1377). Defaults to a self-check of the sibling skeleton against this repo's own services/api/src; --sibling/--frontend-src plus either --estate (resolve the sibling's OWN core from its biffo.sibling.json) or --core-src (an explicit override) point it at a real checked-out sibling instead"
+).option("--sibling <name>", "Label for the report").option("--frontend-src <dir>", "Sibling's frontend source directory to scan").option(
+  "--estate <dir>",
+  "Directory holding every cloned repo; resolves --sibling's OWN core from its biffo.sibling.json core_project field (ignored if --core-src is also given)"
+).option(
+  "--core-src <dir>",
+  "Core API's source directory (ground truth for route prefixes) \u2014 explicit override, takes precedence over --estate resolution"
+).action(
+  async (opts) => {
+    await runCoreDirectPathsCheck(opts);
+  }
+);
 checkCommand.command("cognito-invite-template").description(
   "Refuse a Cognito invite_message_template missing a required member or placeholder (#356) \u2014 terraform validate is silent on this, so a fresh deploy fails on its first apply"
 ).action(async () => {
@@ -12586,7 +12643,7 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync42, readFileSync as readFileSync36 } from "fs";
+import { existsSync as existsSync43, readFileSync as readFileSync36 } from "fs";
 import { join as join50, resolve as resolve18 } from "path";
 import chalk21 from "chalk";
 import { Command as Command24 } from "commander";
@@ -12763,7 +12820,7 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
 }
 function readLocalCoreVersion(cwd) {
   const path = join50(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync42(path)) return null;
+  if (!existsSync43(path)) return null;
   try {
     return parseCoreRecord(readFileSync36(path, "utf8"));
   } catch {
@@ -12781,7 +12838,7 @@ function parseCoreRecord(contents) {
 }
 function readFossil(cwd) {
   const path = join50(cwd, CORE_VERSION_FILE);
-  if (!existsSync42(path)) return null;
+  if (!existsSync43(path)) return null;
   try {
     const value = readFileSync36(path, "utf8").trim();
     return value === "" ? null : value;
@@ -13232,13 +13289,13 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command26 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync43 } from "fs";
+import { existsSync as existsSync44 } from "fs";
 import { dirname as dirname10, join as join51 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
     const candidate = join51(dir, relativePath);
-    if (existsSync43(candidate)) return candidate;
+    if (existsSync44(candidate)) return candidate;
     const parent = dirname10(dir);
     if (parent === dir) return null;
     dir = parent;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.267.4",
+  "version": "0.267.6",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",