@biffo/cli 0.276.0 → 0.276.2

package/dist/index.js

@@ -10065,12 +10065,102 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
   console.log(`\u2713 branch-protection guard: ${owner}/${repo} (${audited.join(", ")}) OK`);
 }
 
-// src/scripts/check-cognito-invite-template.ts
+// src/scripts/check-codeql-suppression.ts
+import { readFileSync as readFileSync28 } from "fs";
+import { join as join38, relative as relative6 } from "path";
 import { execa as execa8 } from "execa";
 
-// src/lib/cognito-invite-template-guard.ts
+// src/lib/codeql-suppression-guard.ts
 import { readdirSync as readdirSync14, readFileSync as readFileSync27, statSync as statSync7 } from "fs";
 import { join as join37 } from "path";
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  ".git",
+  ".worktrees",
+  "node_modules",
+  "dist",
+  "build",
+  ".venv",
+  ".turbo",
+  "coverage"
+]);
+var SCAN_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".mjs", ".py"]);
+var SUPPRESSION_COMMENT = /^\s*(?:\/\/|#|\*)\s*codeql\[[^\]]+\]/;
+function findCodeqlSuppressionComments(source) {
+  const lines = source.split("\n");
+  const hits = [];
+  lines.forEach((line, index) => {
+    if (SUPPRESSION_COMMENT.test(line)) hits.push(index + 1);
+  });
+  return hits;
+}
+function walkSourceFiles(root) {
+  const out = [];
+  const walk2 = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync14(dir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const p = join37(dir, entry);
+      let st;
+      try {
+        st = statSync7(p);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        if (SKIP_DIRS.has(entry)) continue;
+        walk2(p);
+        continue;
+      }
+      const dot = entry.lastIndexOf(".");
+      if (dot === -1) continue;
+      if (SCAN_EXTENSIONS.has(entry.slice(dot))) out.push(p);
+    }
+  };
+  walk2(root);
+  return out.sort();
+}
+function sweepCodeqlSuppressionComments(root) {
+  const hits = [];
+  for (const path of walkSourceFiles(root)) {
+    const text = readFileSync27(path, "utf8");
+    for (const line of findCodeqlSuppressionComments(text)) {
+      hits.push({ path, line, text: text.split("\n")[line - 1] ?? "" });
+    }
+  }
+  return hits;
+}
+
+// src/scripts/check-codeql-suppression.ts
+async function runCodeqlSuppressionCheck() {
+  const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const hits = sweepCodeqlSuppressionComments(join38(root, "cli", "src"));
+  if (hits.length > 0) {
+    console.error(
+      "\u2717 codeql-suppression guard: found a `codeql[...]`-shaped comment, which does not suppress anything in this repo (#1491) \u2014 dismiss the real alert instead (UI, or `PATCH .../code-scanning/alerts/<n>` with a recorded reason)\n"
+    );
+    for (const hit of hits) {
+      console.error(`  ${relative6(root, hit.path)}:${hit.line}  ${hit.text.trim()}`);
+    }
+    process.exit(1);
+  }
+  const probe = readFileSync28(join38(root, "cli", "src", "lib", "codeql-suppression-guard.ts"), "utf8");
+  if (probe.length === 0) {
+    console.error("\u2717 codeql-suppression guard: scan target read empty \u2014 refusing a false green.");
+    process.exit(1);
+  }
+  console.log("\u2713 codeql-suppression guard: no dead `codeql[...]` suppression comment found");
+}
+
+// src/scripts/check-cognito-invite-template.ts
+import { execa as execa9 } from "execa";
+
+// src/lib/cognito-invite-template-guard.ts
+import { readdirSync as readdirSync15, readFileSync as readFileSync29, statSync as statSync8 } from "fs";
+import { join as join39 } from "path";
 var REQUIRED_INVITE_MEMBERS = ["email_subject", "email_message", "sms_message"];
 var REQUIRED_INVITE_PLACEHOLDERS = ["{username}", "{####}"];
 var PLACEHOLDER_MEMBERS = ["email_message", "sms_message"];
@@ -10144,36 +10234,36 @@ function memberBody(blockBody, member) {
 }
 function findModuleTerraformFiles(repoRoot) {
   const found = [];
-  const walk2 = (dir, relative8) => {
+  const walk2 = (dir, relative9) => {
     let entries;
     try {
-      entries = readdirSync14(dir);
+      entries = readdirSync15(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
-      const full = join37(dir, entry);
-      const rel = `${relative8}/${entry}`;
-      if (statSync7(full).isDirectory()) {
+      const full = join39(dir, entry);
+      const rel = `${relative9}/${entry}`;
+      if (statSync8(full).isDirectory()) {
         walk2(full, rel);
       } else if (entry.endsWith(".tf")) {
         found.push(rel);
       }
     }
   };
-  walk2(join37(repoRoot, "modules"), "modules");
+  walk2(join39(repoRoot, "modules"), "modules");
   return found.sort();
 }
 function checkCognitoInviteTemplates(repoRoot) {
   return findModuleTerraformFiles(repoRoot).flatMap(
-    (file) => checkInviteTemplateSource(file, readFileSync27(join37(repoRoot, file), "utf8"))
+    (file) => checkInviteTemplateSource(file, readFileSync29(join39(repoRoot, file), "utf8"))
   );
 }
 
 // src/scripts/check-cognito-invite-template.ts
 async function runCognitoInviteTemplateCheck() {
-  const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findModuleTerraformFiles(root);
   console.log(`audited ${files.length} .tf file(s) under modules/ under ${root}`);
   if (files.length === 0) {
@@ -10195,12 +10285,12 @@ async function runCognitoInviteTemplateCheck() {
 }
 
 // src/scripts/check-core-direct-paths.ts
-import { join as join39 } from "path";
-import { execa as execa9 } from "execa";
+import { join as join41 } from "path";
+import { execa as execa10 } from "execa";
 
 // src/lib/core-direct-paths-audit.ts
-import { existsSync as existsSync36, readFileSync as readFileSync28, readdirSync as readdirSync15, statSync as statSync8 } from "fs";
-import { join as join38 } from "path";
+import { existsSync as existsSync36, readFileSync as readFileSync30, readdirSync as readdirSync16, statSync as statSync9 } from "fs";
+import { join as join40 } from "path";
 var EXTERNAL_BASE_IDENTIFIERS = ["CORE_API_URL"];
 var API_ROUTE_PREFIX = "/api/v1";
 var TEST_FILE_SUFFIXES = [".test.ts", ".test.tsx", ".spec.ts", ".spec.tsx"];
@@ -10359,15 +10449,15 @@ function walkFiles(root, accept, skipDir) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync15(dir);
+      entries = readdirSync16(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join38(dir, entry);
+      const p = join40(dir, entry);
       let st;
       try {
-        st = statSync8(p);
+        st = statSync9(p);
       } catch {
         continue;
       }
@@ -10394,7 +10484,7 @@ function auditFrontendExtraction(frontendSrcDir, externalBases = EXTERNAL_BASE_I
   const extracted = [];
   let rawTotal = 0;
   for (const file of files) {
-    const text = readFileSync28(file, "utf8");
+    const text = readFileSync30(file, "utf8");
     rawTotal += countRawExternalOccurrences(text, externalBases);
     extracted.push(...extractCoreDirectPaths(text, file, externalBases));
   }
@@ -10443,7 +10533,7 @@ function auditCoreRouteExtraction(apiSrcDir) {
   const prefixSet = /* @__PURE__ */ new Set();
   let rawApiRouterCount = 0;
   for (const file of files) {
-    const text = readFileSync28(file, "utf8");
+    const text = readFileSync30(file, "utf8");
     const extraction = extractCoreRoutePrefixes(text);
     rawApiRouterCount += extraction.rawApiRouterCount;
     for (const p of extraction.prefixes) prefixSet.add(normalizePrefix(p));
@@ -10459,10 +10549,10 @@ function pathMatchesAnyCorePrefix(normalized, corePrefixes, apiRoutePrefix = API
 }
 function resolveSiblingCoreSrc(params) {
   const { estateDir, sibling } = params;
-  const configPath = join38(estateDir, sibling, "biffo.sibling.json");
+  const configPath = join40(estateDir, sibling, "biffo.sibling.json");
   let raw;
   try {
-    raw = readFileSync28(configPath, "utf8");
+    raw = readFileSync30(configPath, "utf8");
   } catch (err) {
     throw new Error(
       `cannot resolve ${sibling}'s core: ${configPath} does not exist or is unreadable (${err.message}) -- refusing to guess which core serves this sibling.`
@@ -10482,7 +10572,7 @@ function resolveSiblingCoreSrc(params) {
       `cannot resolve ${sibling}'s core: ${configPath} has no non-empty "core_project" field.`
     );
   }
-  const coreApiSrcDir = join38(estateDir, coreProject, "services", "api", "src");
+  const coreApiSrcDir = join40(estateDir, coreProject, "services", "api", "src");
   if (!existsSync36(coreApiSrcDir)) {
     throw new Error(
       `cannot resolve ${sibling}'s core: biffo.sibling.json names core_project "${coreProject}", but ${coreApiSrcDir} does not exist -- the instance is missing from this estate checkout, not merely unmatched. Refusing to silently skip ${sibling} and shrink the audit's denominator.`
@@ -10524,9 +10614,9 @@ function auditSiblingCoreDirectPaths(params) {
 
 // src/scripts/check-core-direct-paths.ts
 async function runCoreDirectPathsCheck(opts = {}) {
-  const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const sibling = opts.sibling ?? "sibling-template (self-check)";
-  const frontendSrcDir = opts.frontendSrc ?? join39(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
+  const frontendSrcDir = opts.frontendSrc ?? join41(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
   let coreApiSrcDir;
   let coreProject = null;
   if (opts.coreSrc) {
@@ -10542,7 +10632,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
     coreApiSrcDir = resolution.coreApiSrcDir;
     coreProject = resolution.coreProject;
   } else {
-    coreApiSrcDir = join39(root, "services", "api", "src");
+    coreApiSrcDir = join41(root, "services", "api", "src");
   }
   const report = auditSiblingCoreDirectPaths({ sibling, frontendSrcDir, coreApiSrcDir });
   console.log(
@@ -10578,7 +10668,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
 }
 
 // src/scripts/check-core-ownership.ts
-import { execa as execa10 } from "execa";
+import { execa as execa11 } from "execa";
 var BOLD = "\x1B[1m";
 var DIM = "\x1B[2m";
 var RED = "\x1B[31m";
@@ -10589,7 +10679,7 @@ async function runOwnershipCheck(argv) {
   const stagedFlag = args.indexOf("--staged");
   const staged = stagedFlag !== -1;
   const messageFile = staged ? args[stagedFlag + 1] : void 0;
-  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const ownership = classifyRepoOwnership(root);
   if (ownership === "template") {
     console.log("\u2713 core ownership guard: skipped \u2014 this is the template, which owns these paths.");
@@ -10605,11 +10695,11 @@ async function runOwnershipCheck(argv) {
   let deletedFiles = [];
   let commitMessage = "";
   if (staged) {
-    const { stdout } = await execa10("git", ["diff", "--cached", "--name-status"], { cwd: root });
+    const { stdout } = await execa11("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync37, existsSync: existsSync45 } = await import("fs");
-      if (existsSync45(messageFile)) commitMessage = readFileSync37(messageFile, "utf8");
+      const { readFileSync: readFileSync39, existsSync: existsSync45 } = await import("fs");
+      if (existsSync45(messageFile)) commitMessage = readFileSync39(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -10617,18 +10707,18 @@ async function runOwnershipCheck(argv) {
       console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
       process.exit(2);
     }
-    await execa10("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-    const { stdout } = await execa10("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
+    await execa11("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+    const { stdout } = await execa11("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
       cwd: root
     });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
-    const { stdout: log2 } = await execa10("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
+    const { stdout: log2 } = await execa11("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
       cwd: root,
       reject: false
     });
     commitMessage = log2;
   }
-  const { stdout: gitBranch } = await execa10("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+  const { stdout: gitBranch } = await execa11("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
     cwd: root,
     reject: false
   });
@@ -10710,12 +10800,12 @@ ${BOLD}If the divergence is deliberate${OFF}
 }
 
 // src/scripts/check-eventbridge-log-permissions.ts
-import { execa as execa11 } from "execa";
+import { execa as execa12 } from "execa";
 
 // src/lib/eventbridge-log-permission-guard.ts
-import { readFileSync as readFileSync29, readdirSync as readdirSync16, statSync as statSync9 } from "fs";
-import { join as join40 } from "path";
-var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
+import { readFileSync as readFileSync31, readdirSync as readdirSync17, statSync as statSync10 } from "fs";
+import { join as join42 } from "path";
+var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
 var LOG_RESOURCE_POLICY_TYPE = "aws_cloudwatch_log_resource_policy";
 var LOG_GROUP_ARN_REF = /aws_cloudwatch_log_group\.([\w-]+)(?:\[[^\]]*\])?\.arn/g;
@@ -10786,20 +10876,20 @@ function walkTerraformFiles(root) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync16(dir);
+      entries = readdirSync17(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join40(dir, entry);
+      const p = join42(dir, entry);
       let st;
       try {
-        st = statSync9(p);
+        st = statSync10(p);
       } catch {
         continue;
       }
       if (st.isDirectory()) {
-        if (SKIP_DIRS.has(entry)) continue;
+        if (SKIP_DIRS2.has(entry)) continue;
         walk2(p);
         continue;
       }
@@ -10834,7 +10924,7 @@ function auditEventBridgeLogPermissions(root) {
   let rawEventTargetCount = 0;
   let rawLogPolicyCount = 0;
   for (const file of files) {
-    const text = readFileSync29(file, "utf8");
+    const text = readFileSync31(file, "utf8");
     rawEventTargetCount += countRawResourceDeclarations(text, EVENT_TARGET_TYPE);
     rawLogPolicyCount += countRawResourceDeclarations(text, LOG_RESOURCE_POLICY_TYPE);
     eventTargetBlocks.push(...findResourceBlocks(text, file, EVENT_TARGET_TYPE));
@@ -10887,7 +10977,7 @@ function auditEventBridgeLogPermissions(root) {
 
 // src/scripts/check-eventbridge-log-permissions.ts
 async function runEventBridgeLogPermissionCheck() {
-  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let report;
   try {
     report = auditEventBridgeLogPermissions(root);
@@ -10924,15 +11014,15 @@ async function runEventBridgeLogPermissionCheck() {
 }
 
 // src/scripts/check-lambda-output.ts
-import { execa as execa12 } from "execa";
+import { execa as execa13 } from "execa";
 
 // src/lib/lambda-output-guard.ts
-import { readFileSync as readFileSync31 } from "fs";
-import { join as join42 } from "path";
+import { readFileSync as readFileSync33 } from "fs";
+import { join as join44 } from "path";
 
 // src/lib/terraform-input-guard.ts
-import { readdirSync as readdirSync17, readFileSync as readFileSync30, statSync as statSync10 } from "fs";
-import { join as join41 } from "path";
+import { readdirSync as readdirSync18, readFileSync as readFileSync32, statSync as statSync11 } from "fs";
+import { join as join43 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
   "plan",
@@ -10947,20 +11037,20 @@ function stripComments2(source) {
 }
 function findWorkflowFiles(repoRoot) {
   const found = [];
-  const walk2 = (dir, relative8) => {
+  const walk2 = (dir, relative9) => {
     let entries;
     try {
-      entries = readdirSync17(dir);
+      entries = readdirSync18(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
-      const full = join41(dir, entry);
-      const rel = relative8 ? `${relative8}/${entry}` : entry;
-      if (statSync10(full).isDirectory()) {
+      const full = join43(dir, entry);
+      const rel = relative9 ? `${relative9}/${entry}` : entry;
+      if (statSync11(full).isDirectory()) {
         walk2(full, rel);
-      } else if (/\.ya?ml$/.test(entry) && relative8.endsWith(".github/workflows")) {
+      } else if (/\.ya?ml$/.test(entry) && relative9.endsWith(".github/workflows")) {
         found.push(rel);
       }
     }
@@ -11000,7 +11090,7 @@ function checkWorkflowSource(file, rawSource) {
 }
 function checkTerraformInput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource(file, readFileSync30(join41(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource(file, readFileSync32(join43(repoRoot, file), "utf8"))
   );
 }
 
@@ -11058,13 +11148,13 @@ function checkWorkflowSource2(file, rawSource) {
 }
 function checkLambdaOutput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource2(file, readFileSync31(join42(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource2(file, readFileSync33(join44(repoRoot, file), "utf8"))
   );
 }
 
 // src/scripts/check-lambda-output.ts
 async function runLambdaOutputCheck() {
-  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -11086,9 +11176,9 @@ async function runLambdaOutputCheck() {
 }
 
 // src/scripts/check-pipe-trap.ts
-import { readFileSync as readFileSync32, readdirSync as readdirSync18 } from "fs";
-import { join as join43, relative as relative6 } from "path";
-import { execa as execa13 } from "execa";
+import { readFileSync as readFileSync34, readdirSync as readdirSync19 } from "fs";
+import { join as join45, relative as relative7 } from "path";
+import { execa as execa14 } from "execa";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -11184,23 +11274,23 @@ function findPipeTraps(source) {
 function shellFiles(root) {
   const out = [];
   for (const dir of ["scripts", ".githooks"]) {
-    const full = join43(root, dir);
+    const full = join45(root, dir);
     let entries;
     try {
-      entries = readdirSync18(full, { withFileTypes: true });
+      entries = readdirSync19(full, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
-      out.push(join43(full, entry.name));
+      out.push(join45(full, entry.name));
     }
   }
   return out;
 }
 async function runPipeTrapCheck() {
-  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = shellFiles(root);
   console.log(`audited ${files.length} shell file(s) under scripts/ and .githooks/ under ${root}`);
   if (files.length === 0) {
@@ -11210,8 +11300,8 @@ async function runPipeTrapCheck() {
     process.exit(1);
   }
   const findings = files.flatMap(
-    (file) => findPipeTraps(readFileSync32(file, "utf8")).map(
-      (t) => `${relative6(root, file)}:${t.line}  ${t.text}
+    (file) => findPipeTraps(readFileSync34(file, "utf8")).map(
+      (t) => `${relative7(root, file)}:${t.line}  ${t.text}
     ${t.reason}`
     )
   );
@@ -11228,33 +11318,33 @@ async function runPipeTrapCheck() {
 
 // src/scripts/check-plugin-collisions.ts
 import { existsSync as existsSync38 } from "fs";
-import { join as join45 } from "path";
-import { execa as execa14 } from "execa";
+import { join as join47 } from "path";
+import { execa as execa15 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync37, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
-import { join as join44 } from "path";
+import { existsSync as existsSync37, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
+import { join as join46 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
   if (!existsSync37(dir)) return [];
-  return readdirSync19(dir).filter((entry) => {
+  return readdirSync20(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync11(join44(dir, entry)).isDirectory();
+      return statSync12(join46(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync37(join44(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync37(join46(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join44(pluginDir2, "tests");
+  const testsDir = join46(pluginDir2, "tests");
   if (!existsSync37(testsDir)) return [];
-  if (existsSync37(join44(testsDir, "__init__.py"))) return [];
-  return readdirSync19(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
+  if (existsSync37(join46(testsDir, "__init__.py"))) return [];
+  return readdirSync20(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
   const plugins = (pluginDirs ?? subdirectories(servicesDir)).filter((name) => !name.startsWith("_")).filter((name) => name !== "api").sort();
@@ -11262,7 +11352,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join44(servicesDir, plugin))) {
+      for (const name of namesOf(join46(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -11299,8 +11389,8 @@ function formatCollisions(collisions) {
 
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
-  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join45(root, "services");
+  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const servicesDir = join47(root, "services");
   if (!existsSync38(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
@@ -11318,28 +11408,28 @@ async function runPluginCollisionCheck() {
 }
 
 // src/scripts/check-plugin-terraform.ts
-import { execa as execa15 } from "execa";
+import { execa as execa16 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync39, readFileSync as readFileSync33, readdirSync as readdirSync20 } from "fs";
-import { dirname as dirname10, join as join46, relative as relative7, sep as sep3 } from "path";
-var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
+import { existsSync as existsSync39, readFileSync as readFileSync35, readdirSync as readdirSync21 } from "fs";
+import { dirname as dirname10, join as join48, relative as relative8, sep as sep3 } from "path";
+var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
   const found = [];
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync20(dir, { withFileTypes: true });
+      entries = readdirSync21(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (SKIP_DIRS2.has(entry.name)) continue;
-        walk2(join46(dir, entry.name));
+        if (SKIP_DIRS3.has(entry.name)) continue;
+        walk2(join48(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative7(root, join46(dir, entry.name)).split(sep3).join("/"));
+        found.push(relative8(root, join48(dir, entry.name)).split(sep3).join("/"));
       }
     }
   };
@@ -11349,7 +11439,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync33(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync35(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -11364,15 +11454,15 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync39(join46(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync39(join48(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join46(root, manifest);
+    const absManifest = join48(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
-    if (existsSync39(join46(pluginDir2, "terraform"))) continue;
-    const relPluginDir = relative7(root, pluginDir2).split(sep3).join("/");
+    if (existsSync39(join48(pluginDir2, "terraform"))) continue;
+    const relPluginDir = relative8(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
       expectedTerraformDir: relPluginDir ? `${relPluginDir}/terraform` : "terraform",
@@ -11391,7 +11481,7 @@ function formatViolations(violations) {
 
 // src/scripts/check-plugin-terraform.ts
 async function runPluginTerraformCheck() {
-  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const violations = checkPluginTerraform(root);
   if (violations.length > 0) {
     console.error("\u2717 plugin Terraform guard: event subscriptions with no infrastructure\n");
@@ -11403,12 +11493,12 @@ async function runPluginTerraformCheck() {
 
 // src/scripts/check-plugin-tool-supply.ts
 import { existsSync as existsSync41 } from "fs";
-import { join as join48 } from "path";
-import { execa as execa16 } from "execa";
+import { join as join50 } from "path";
+import { execa as execa17 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync40, readFileSync as readFileSync34, readdirSync as readdirSync21, statSync as statSync12 } from "fs";
-import { join as join47 } from "path";
+import { existsSync as existsSync40, readFileSync as readFileSync36, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
+import { join as join49 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -11819,13 +11909,13 @@ var OPENROUTER_MODEL_IDS = [
 function listDirs(root) {
   let entries;
   try {
-    entries = readdirSync21(root);
+    entries = readdirSync22(root);
   } catch {
     return [];
   }
   return entries.filter((e) => {
     try {
-      return statSync12(join47(root, e)).isDirectory();
+      return statSync13(join49(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -11836,15 +11926,15 @@ function walkFiles2(root, accept, skipDir) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync21(dir);
+      entries = readdirSync22(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join47(dir, entry);
+      const p = join49(dir, entry);
       let st;
       try {
-        st = statSync12(p);
+        st = statSync13(p);
       } catch {
         continue;
       }
@@ -11867,14 +11957,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join47(pluginDir2, "terraform");
+  const tfDir = join49(pluginDir2, "terraform");
   let entries;
   try {
-    entries = readdirSync21(tfDir);
+    entries = readdirSync22(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join47(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join49(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -12126,8 +12216,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join47("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join47(
+var CONFIG_PY_PATH = join49("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join49(
   "services",
   "api",
   "src",
@@ -12139,8 +12229,8 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join47(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join47(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configPath = join49(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join49(repoRoot, ORCHESTRATION_SCHEMA_PATH);
   const configMissing = !existsSync40(configPath);
   const orchestrationSchemaMissing = !existsSync40(orchestrationPath);
   const knownSet = new Set(knownModelIds);
@@ -12160,13 +12250,13 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   };
   let settingsBlind = false;
   if (!configMissing) {
-    const settingsFields = extractSettingsModelFields(readFileSync34(configPath, "utf8"));
+    const settingsFields = extractSettingsModelFields(readFileSync36(configPath, "utf8"));
     if (settingsFields.length === 0) settingsBlind = true;
     for (const { field, value } of settingsFields) record(`${CONFIG_PY_PATH}#${field}`, value);
   }
   let curatedFieldsBlind = false;
   if (!orchestrationSchemaMissing) {
-    const curated = extractCuratedModelFields(readFileSync34(orchestrationPath, "utf8"));
+    const curated = extractCuratedModelFields(readFileSync36(orchestrationPath, "utf8"));
     if (curated.rawFieldCount > 0 && curated.fields.every((f) => f.defaultValue === null && f.optionValues.length === 0)) {
       curatedFieldsBlind = true;
     }
@@ -12213,7 +12303,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync12(join47(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync13(join49(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -12226,8 +12316,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join47(pluginsRoot, name);
-    const manifestText = readFileSync34(join47(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join49(pluginsRoot, name);
+    const manifestText = readFileSync36(join49(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -12245,13 +12335,13 @@ function auditPluginToolSupply(pluginsRoot) {
     totalDeclaredTools += manifest.tools.length;
     const pySources = pluginPythonFiles(pluginDir2).map((f) => ({
       file: f,
-      text: readFileSync34(f, "utf8")
+      text: readFileSync36(f, "utf8")
     }));
     const resolver = buildSymbolResolver(pySources);
     const registry = extractToolRegistryEntries(pySources, resolver);
     if (registry.rawToolDefinitionCount > 0 && registry.entries.length === 0) registryBlind = true;
     const tfFiles = pluginTerraformFiles(pluginDir2);
-    const tfText = tfFiles.map((f) => readFileSync34(f, "utf8")).join("\n");
+    const tfText = tfFiles.map((f) => readFileSync36(f, "utf8")).join("\n");
     const terraform = extractTerraformEnvKeys(tfText);
     if (terraform.rawMarkerCount > 0 && terraform.resolvedBlockCount === 0) terraformBlind = true;
     for (const toolName of manifest.tools) {
@@ -12325,7 +12415,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join47(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join49(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -12356,9 +12446,9 @@ function auditPluginToolSupply(pluginsRoot) {
 
 // src/scripts/check-plugin-tool-supply.ts
 async function runPluginToolSupplyCheck() {
-  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
-  const pluginsRoot = join48(root, "services", "_plugins");
+  const pluginsRoot = join50(root, "services", "_plugins");
   if (!existsSync41(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
@@ -12389,7 +12479,7 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join48(root, "services", "api");
+  const servicesApiRoot = join50(root, "services", "api");
   if (!existsSync41(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
@@ -12436,7 +12526,7 @@ async function runPluginToolSupplyCheck() {
 }
 
 // src/scripts/check-release-subject.ts
-import { execa as execa17 } from "execa";
+import { execa as execa18 } from "execa";
 
 // src/lib/release-version.ts
 var MINOR_TYPES = /* @__PURE__ */ new Set(["feat"]);
@@ -12473,7 +12563,7 @@ async function fetchPrTitleViaGh({
   PR_NUMBER,
   GH_REPO
 }) {
-  const { stdout } = await execa17(
+  const { stdout } = await execa18(
     "gh",
     ["pr", "view", PR_NUMBER, "--repo", GH_REPO, "--json", "title", "--jq", ".title"],
     { env: { ...process.env, GH_TOKEN } }
@@ -12509,7 +12599,7 @@ async function resolveReleaseSubject({
       );
     }
   }
-  return (await execa17("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
+  return (await execa18("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
 }
 async function runReleaseSubjectCheck(argv) {
   const base = process.env["GITHUB_BASE_REF"] ?? argv[0];
@@ -12517,9 +12607,9 @@ async function runReleaseSubjectCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  await execa17("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa17("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
+  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  await execa18("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa18("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
     cwd: root
   });
   const changedFiles = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -12567,13 +12657,13 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync42, readdirSync as readdirSync23 } from "fs";
-import { join as join50 } from "path";
-import { execa as execa18 } from "execa";
+import { existsSync as existsSync42, readdirSync as readdirSync24 } from "fs";
+import { join as join52 } from "path";
+import { execa as execa19 } from "execa";
 
 // src/lib/skeleton-drift-guard.ts
-import { readFileSync as readFileSync35, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
-import { join as join49 } from "path";
+import { readFileSync as readFileSync37, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
+import { join as join51 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -12631,16 +12721,16 @@ function walk(dir, base = dir) {
   const out = [];
   let entries;
   try {
-    entries = readdirSync22(dir);
+    entries = readdirSync23(dir);
   } catch {
     return out;
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join49(dir, entry);
+    const abs = join51(dir, entry);
     let isDir;
     try {
-      isDir = statSync13(abs).isDirectory();
+      isDir = statSync14(abs).isDirectory();
     } catch {
       continue;
     }
@@ -12659,7 +12749,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync35(join49(skeletonRoot, rel), "utf8");
+        contents = readFileSync37(join51(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -12688,23 +12778,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join50(root, "_skeletons");
+  const skeletonsDir = join52(root, "_skeletons");
   let entries;
   try {
-    entries = readdirSync23(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    entries = readdirSync24(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync42(join50(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync42(join52(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
-  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join50(root, "_skeletons", name);
+    const skeletonRoot = join52(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync42(join50(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync42(join52(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -12718,7 +12808,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join50(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join52(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -12730,9 +12820,9 @@ async function runSkeletonDriftCheck() {
 }
 
 // src/scripts/check-terraform-input.ts
-import { execa as execa19 } from "execa";
+import { execa as execa20 } from "execa";
 async function runTerraformInputCheck() {
-  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -12755,7 +12845,7 @@ async function runTerraformInputCheck() {
 
 // src/commands/check.ts
 var checkCommand = new Command23("check").description(
-  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, cognito-invite-template, lambda-output, pipe-trap, skeleton-drift, terraform-input) run in CI and git hooks, plus out-of-band audits (branch protection)"
+  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input) run in CI and git hooks, plus out-of-band audits (branch protection)"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
   await runOwnershipCheck(rawArgsAfter("ownership"));
@@ -12812,6 +12902,11 @@ checkCommand.command("pipe-trap").description(
 ).action(async () => {
   await runPipeTrapCheck();
 });
+checkCommand.command("codeql-suppression").description(
+  "Refuse a `// codeql[query-id]` comment anywhere in cli/src (#1491) \u2014 it does not suppress anything in this repo's CodeQL setup; alert #21 stayed open under one"
+).action(async () => {
+  await runCodeqlSuppressionCheck();
+});
 checkCommand.command("skeleton-drift").description(
   "Refuse a fix this repo made for itself that never reached _skeletons/ \u2014 a hardcoded runner, the paid gitleaks action, an unhardened dependency audit, a hard-coded app title"
 ).action(async () => {
@@ -12836,8 +12931,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync43, readFileSync as readFileSync36 } from "fs";
-import { join as join51, resolve as resolve18 } from "path";
+import { existsSync as existsSync43, readFileSync as readFileSync38 } from "fs";
+import { join as join53, resolve as resolve18 } from "path";
 import chalk21 from "chalk";
 import { Command as Command24 } from "commander";
 
@@ -13012,10 +13107,10 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
   return runDoctorChecks(facts);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join51(cwd, INSTANCE_CORE_FILE);
+  const path = join53(cwd, INSTANCE_CORE_FILE);
   if (!existsSync43(path)) return null;
   try {
-    return parseCoreRecord(readFileSync36(path, "utf8"));
+    return parseCoreRecord(readFileSync38(path, "utf8"));
   } catch {
     return null;
   }
@@ -13030,10 +13125,10 @@ function parseCoreRecord(contents) {
   }
 }
 function readFossil(cwd) {
-  const path = join51(cwd, CORE_VERSION_FILE);
+  const path = join53(cwd, CORE_VERSION_FILE);
   if (!existsSync43(path)) return null;
   try {
-    const value = readFileSync36(path, "utf8").trim();
+    const value = readFileSync38(path, "utf8").trim();
     return value === "" ? null : value;
   } catch {
     return null;
@@ -13483,11 +13578,11 @@ import { Command as Command26 } from "commander";
 
 // src/lib/packaged-scripts.ts
 import { existsSync as existsSync44 } from "fs";
-import { dirname as dirname11, join as join52 } from "path";
+import { dirname as dirname11, join as join54 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join52(dir, relativePath);
+    const candidate = join54(dir, relativePath);
     if (existsSync44(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.276.0",
+  "version": "0.276.2",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",