@biffo/cli 0.283.1 → 0.283.3

package/dist/index.js

@@ -3007,8 +3007,16 @@ var GLOBAL_DISPATCH_WORKFLOW_PATHS = [
 ];
 
 // src/lib/plugin-terraform-wiring.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync9, readdirSync as readdirSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join12 } from "path";
+import {
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync9,
+  readdirSync as readdirSync3,
+  rmSync as rmSync4,
+  statSync as statSync2,
+  writeFileSync as writeFileSync4
+} from "fs";
+import { join as join12, relative as relative2, sep as sep2 } from "path";
 var TEMPLATE_MODULE_DIR = "_template";
 var DEFAULT_PLUGIN_HANDLER = "src.lambda.main.handler";
 var GENERATED_TF_FILE = "plugins.generated.tf";
@@ -3096,6 +3104,62 @@ function staleFirstPartyCopies(cwd) {
   const copied = new Set(listPluginModules(cwd));
   return firstPartyPluginNames(cwd).filter((name) => copied.has(name));
 }
+function walkTfFiles(root) {
+  const out = [];
+  const walk2 = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync3(dir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const p = join12(dir, entry);
+      let st;
+      try {
+        st = statSync2(p);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        walk2(p);
+        continue;
+      }
+      if (entry.endsWith(".tf")) out.push(p);
+    }
+  };
+  walk2(root);
+  return out.sort();
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function findPluginModuleReferences(cwd, name) {
+  const infraDir = join12(cwd, "infra");
+  const sourceSegments = ["modules", "plugins", name];
+  const sourceLinePattern = /^\s*source\s*=\s*"([^"]+)"/;
+  const moduleRefPattern = new RegExp(`module\\.plugin_${escapeRegExp(name)}(?![A-Za-z0-9_-])`);
+  const refs = [];
+  for (const absPath of walkTfFiles(infraDir)) {
+    let contents;
+    try {
+      contents = readFileSync9(absPath, "utf8");
+    } catch {
+      continue;
+    }
+    const relPath = relative2(cwd, absPath).split(sep2).join("/");
+    contents.split("\n").forEach((rawLine, idx) => {
+      const sourceValue = sourceLinePattern.exec(rawLine)?.[1];
+      const sourceValueSegments = sourceValue?.split("/").filter((s) => s.length > 0 && s !== ".");
+      const isSourceRef = sourceValueSegments !== void 0 && sourceValueSegments.slice(-sourceSegments.length).join("/") === sourceSegments.join("/");
+      const isExprRef = moduleRefPattern.test(rawLine);
+      if (isSourceRef || isExprRef) {
+        refs.push({ file: relPath, line: idx + 1, text: rawLine.trim() });
+      }
+    });
+  }
+  return refs;
+}
 function listEnvironments(cwd) {
   const dir = join12(cwd, "infra", "environments");
   let entries;
@@ -4643,7 +4707,7 @@ import {
   readdirSync as readdirSync4,
   readFileSync as readFileSync10,
   rmSync as rmSync6,
-  statSync as statSync2,
+  statSync as statSync3,
   writeFileSync as writeFileSync5
 } from "fs";
 import { homedir } from "os";
@@ -4677,7 +4741,7 @@ function findLatestSession() {
   if (files.length === 0) return null;
   const sorted = files.map((f) => {
     const fullPath = join16(dir, f);
-    const mtime = existsSync15(fullPath) ? statSync2(fullPath).mtimeMs : -1;
+    const mtime = existsSync15(fullPath) ? statSync3(fullPath).mtimeMs : -1;
     return { f, mtime };
   }).sort((a, b) => b.mtime - a.mtime);
   try {
@@ -4875,7 +4939,7 @@ async function resolveConfig(options) {
 
 // src/commands/data-import.ts
 import { execSync as execSync3 } from "child_process";
-import { cpSync, existsSync as existsSync17, mkdirSync as mkdirSync5, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
+import { cpSync, existsSync as existsSync17, mkdirSync as mkdirSync5, readdirSync as readdirSync5, statSync as statSync4 } from "fs";
 import { join as join17, resolve as resolve5 } from "path";
 import chalk6 from "chalk";
 import { Command as Command6 } from "commander";
@@ -4928,7 +4992,7 @@ async function runDataImport(name, options, deps) {
       `DDL import '${name}' is already present at db/imports/${name}/. Remove it first to re-import.`
     );
   }
-  const isLocalDir = existsSync17(options.source) && statSync3(options.source).isDirectory();
+  const isLocalDir = existsSync17(options.source) && statSync4(options.source).isDirectory();
   let sourceDir;
   let cleanupClone = null;
   if (isLocalDir) {
@@ -6013,8 +6077,8 @@ import { Command as Command12 } from "commander";
 import inquirer5 from "inquirer";
 
 // src/lib/build-freshness.ts
-import { existsSync as existsSync20, readdirSync as readdirSync7, statSync as statSync4 } from "fs";
-import { dirname as dirname5, join as join19, relative as relative2, sep as sep2 } from "path";
+import { existsSync as existsSync20, readdirSync as readdirSync7, statSync as statSync5 } from "fs";
+import { dirname as dirname5, join as join19, relative as relative3, sep as sep3 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var SKIP_ENV_VAR = "BIFFO_SKIP_BUILD_FRESHNESS_CHECK";
 function checkBuildFreshness(options = {}) {
@@ -6048,8 +6112,8 @@ function checkBuildFreshness(options = {}) {
   if (!existsSync20(entry)) {
     return { status: "skipped", reason: `${entry} not found`, newerSources: [] };
   }
-  const builtAt = statSync4(entry).mtimeMs;
-  const newer = collectSourceFiles(srcDir).map((file) => ({ file, mtimeMs: statSync4(file).mtimeMs })).filter((f) => f.mtimeMs > builtAt).sort((a, b) => b.mtimeMs - a.mtimeMs).map((f) => relative2(packageRoot, f.file));
+  const builtAt = statSync5(entry).mtimeMs;
+  const newer = collectSourceFiles(srcDir).map((file) => ({ file, mtimeMs: statSync5(file).mtimeMs })).filter((f) => f.mtimeMs > builtAt).sort((a, b) => b.mtimeMs - a.mtimeMs).map((f) => relative3(packageRoot, f.file));
   if (newer.length === 0) {
     return { status: "fresh", reason: "dist is newer than src", newerSources: [] };
   }
@@ -6116,8 +6180,8 @@ function findPackageRoot(from) {
 }
 function isInside(parent, child) {
   if (child === parent) return true;
-  const rel = relative2(parent, child);
-  return rel !== "" && !rel.startsWith("..") && !rel.startsWith(`..${sep2}`);
+  const rel = relative3(parent, child);
+  return rel !== "" && !rel.startsWith("..") && !rel.startsWith(`..${sep3}`);
 }
 
 // src/lib/credentials.ts
@@ -6402,7 +6466,7 @@ import {
   readdirSync as readdirSync8,
   readFileSync as readFileSync15,
   rmSync as rmSync7,
-  statSync as statSync5,
+  statSync as statSync6,
   writeFileSync as writeFileSync6
 } from "fs";
 import { homedir as homedir3 } from "os";
@@ -8479,8 +8543,8 @@ function printEntry(entry) {
 }
 
 // src/commands/plugin-install.ts
-import { cpSync as cpSync5, existsSync as existsSync30, mkdirSync as mkdirSync11, readFileSync as readFileSync22, statSync as statSync6 } from "fs";
-import { join as join32, relative as relative3, resolve as resolve12 } from "path";
+import { cpSync as cpSync5, existsSync as existsSync30, mkdirSync as mkdirSync11, readFileSync as readFileSync22, statSync as statSync7 } from "fs";
+import { join as join32, relative as relative4, resolve as resolve12 } from "path";
 import chalk15 from "chalk";
 import { Command as Command15 } from "commander";
 
@@ -8794,8 +8858,8 @@ function ensureWorkspaceSources(pluginPyprojectPath, memberNames) {
     updated = `${text.slice(0, insertAt)}
 ${lines.join("\n")}${text.slice(insertAt)}`;
   } else {
-    const sep4 = text.endsWith("\n") ? "" : "\n";
-    updated = `${text}${sep4}
+    const sep5 = text.endsWith("\n") ? "" : "\n";
+    updated = `${text}${sep5}
 # Vendored into this instance by \`biffo plugin install\`: resolve dependencies the
 # instance's uv workspace provides as members from the workspace, not PyPI.
 [tool.uv.sources]
@@ -8850,7 +8914,7 @@ function resolveLocalPlugin(localPath) {
   if (!existsSync30(localPath)) {
     throw new Error(`--local path does not exist: ${localPath}`);
   }
-  if (!statSync6(localPath).isDirectory()) {
+  if (!statSync7(localPath).isDirectory()) {
     throw new Error(`--local path is not a directory: ${localPath}`);
   }
   const manifestPath = join32(localPath, "biffo.plugin.json");
@@ -9009,10 +9073,10 @@ async function runPluginInstall(target, options, deps) {
       log.info(`Generating migration for ${relTargetDir}/'s ${manifest.tables.length} table(s)...`);
       const generatedPaths = await deps.migrations.generate(options.cwd, [pluginName]);
       for (const absPath of generatedPaths) {
-        stagePaths.push(relative3(options.cwd, absPath));
+        stagePaths.push(relative4(options.cwd, absPath));
       }
       if (generatedPaths.length > 0) {
-        log.success(`Generated migration: ${relative3(options.cwd, generatedPaths[0])}`);
+        log.success(`Generated migration: ${relative4(options.cwd, generatedPaths[0])}`);
       }
     } else {
       log.info(`${pluginName} declares no tables \u2014 nothing to migrate.`);
@@ -9143,8 +9207,8 @@ import { resolve as resolve14 } from "path";
 import { Command as Command17 } from "commander";
 
 // src/lib/plugin-staleness.ts
-import { existsSync as existsSync32, readFileSync as readFileSync24, readdirSync as readdirSync14, statSync as statSync7 } from "fs";
-import { join as join34, relative as relative4 } from "path";
+import { existsSync as existsSync32, readFileSync as readFileSync24, readdirSync as readdirSync14, statSync as statSync8 } from "fs";
+import { join as join34, relative as relative5 } from "path";
 function discoverVendoredPlugins(servicesDir) {
   if (!existsSync32(servicesDir)) return [];
   return readdirSync14(servicesDir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith("_") && e.name !== "api").map((e) => e.name).filter((name) => existsSync32(join34(servicesDir, name, "biffo.plugin.json"))).sort();
@@ -9347,11 +9411,11 @@ function walkExcluding(root, dir, excludes) {
   for (const entry of readdirSync14(dir)) {
     if (excludes.has(entry) || entry === ".git") continue;
     const full = join34(dir, entry);
-    const stat = statSync7(full);
+    const stat = statSync8(full);
     if (stat.isDirectory()) {
       out.push(...walkExcluding(root, full, excludes));
     } else {
-      out.push(relative4(root, full));
+      out.push(relative5(root, full));
     }
   }
   return out;
@@ -9399,7 +9463,7 @@ var pluginStalenessCommand = new Command17("staleness").description(
 
 // src/commands/plugin-sync-migrations.ts
 import { existsSync as existsSync33 } from "fs";
-import { join as join35, relative as relative5, resolve as resolve15 } from "path";
+import { join as join35, relative as relative6, resolve as resolve15 } from "path";
 import chalk17 from "chalk";
 import { Command as Command18 } from "commander";
 var pluginSyncMigrationsCommand = new Command18("sync-migrations").description(
@@ -9440,7 +9504,7 @@ async function runPluginSyncMigrations(name, options, deps) {
     );
     return;
   }
-  const relativePaths = generated.map((p) => relative5(options.cwd, p));
+  const relativePaths = generated.map((p) => relative6(options.cwd, p));
   for (const p of relativePaths) {
     log.success(`Generated ${p}`);
   }
@@ -9532,6 +9596,19 @@ async function runPluginUninstall(name, options, deps) {
       `${options.cwd} is not a git repository \u2014 biffo plugin uninstall must be run from a Biffo project checkout.`
     );
   }
+  if (existsSync34(modulesDir)) {
+    const refs = findPluginModuleReferences(options.cwd, name).filter(
+      (r) => !r.file.endsWith(`/${GENERATED_TF_FILE}`) && r.file !== GENERATED_TF_FILE
+    );
+    if (refs.length > 0) {
+      const refList = refs.map((r) => `  ${r.file}:${r.line}  ${r.text}`).join("\n");
+      throw new Error(
+        `Refusing to uninstall '${name}' \u2014 its Terraform module is referenced outside the generated wiring, so removing it would break these hand-authored file(s):
+${refList}
+Remove the reference(s) above first, then re-run uninstall.`
+      );
+    }
+  }
   rmSync9(targetDir, { recursive: true, force: true });
   log.success(`Removed services/${name}/`);
   if (existsSync34(modulesDir)) {
@@ -9613,7 +9690,7 @@ function printDryRun5(name, version, stagePaths, keepData) {
 
 // src/commands/plugin-upgrade.ts
 import { cpSync as cpSync6, existsSync as existsSync35, mkdirSync as mkdirSync12, readFileSync as readFileSync26, rmSync as rmSync10 } from "fs";
-import { join as join37, relative as relative6, resolve as resolve17 } from "path";
+import { join as join37, relative as relative7, resolve as resolve17 } from "path";
 import chalk19 from "chalk";
 import { Command as Command20 } from "commander";
 import inquirer7 from "inquirer";
@@ -9713,6 +9790,9 @@ async function runPluginUpgrade(target, options, deps) {
     log.success(
       `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
     );
+    if (!existsSync35(join37(tmpDir, "terraform"))) {
+      refuseIfModuleStillReferenced(options.cwd, modulesDir, entry.name);
+    }
     const previousProvenance = readProvenance(targetDir);
     rmSync10(targetDir, { recursive: true, force: true });
     mkdirSync12(targetDir, { recursive: true });
@@ -9741,10 +9821,10 @@ async function runPluginUpgrade(target, options, deps) {
       );
       const generatedPaths = await deps.migrations.generate(options.cwd, [entry.name]);
       for (const absPath of generatedPaths) {
-        stagePaths.push(relative6(options.cwd, absPath));
+        stagePaths.push(relative7(options.cwd, absPath));
       }
       if (generatedPaths.length > 0) {
-        log.success(`Generated migration: ${relative6(options.cwd, generatedPaths[0])}`);
+        log.success(`Generated migration: ${relative7(options.cwd, generatedPaths[0])}`);
       } else {
         log.info(
           `${entry.name}'s tables and columns already match the manifest \u2014 no migration needed.`
@@ -9805,6 +9885,9 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     log.success(
       `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
     );
+    if (!existsSync35(join37(source.sourceDir, "terraform"))) {
+      refuseIfModuleStillReferenced(options.cwd, modulesDir, source.name);
+    }
     const previousProvenance = readProvenance(targetDir);
     if (inTreeSource) {
       log.info(
@@ -9836,10 +9919,10 @@ async function runLocalPluginRefresh(localPath, options, deps) {
       );
       const generatedPaths = await deps.migrations.generate(options.cwd, [source.name]);
       for (const absPath of generatedPaths) {
-        stagePaths.push(relative6(options.cwd, absPath));
+        stagePaths.push(relative7(options.cwd, absPath));
       }
       if (generatedPaths.length > 0) {
-        log.success(`Generated migration: ${relative6(options.cwd, generatedPaths[0])}`);
+        log.success(`Generated migration: ${relative7(options.cwd, generatedPaths[0])}`);
       } else {
         log.info(
           `${source.name}'s tables and columns already match the manifest \u2014 no migration needed.`
@@ -9870,6 +9953,17 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     source.cleanup();
   }
 }
+function refuseIfModuleStillReferenced(cwd, modulesDir, name) {
+  if (!existsSync35(modulesDir)) return;
+  const refs = findPluginModuleReferences(cwd, name);
+  if (refs.length === 0) return;
+  const refList = refs.map((r) => `  ${r.file}:${r.line}  ${r.text}`).join("\n");
+  throw new Error(
+    `Refusing to remove modules/plugins/${name}/ \u2014 '${name}' ships no terraform/ directory in this version, but the module is still referenced:
+${refList}
+A plugin repo without terraform/ is missing the directory, not declaring that the module should go, and a wrong destructive action here is worse than no action. Either remove the reference(s) above yourself, or run 'biffo plugin uninstall ${name}', which removes the module and unwires the reference together.`
+  );
+}
 function readInstalledVersion2(targetDir) {
   const manifestPath = join37(targetDir, "biffo.plugin.json");
   if (!existsSync35(manifestPath)) return void 0;
@@ -10595,11 +10689,11 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
 
 // src/scripts/check-codeql-suppression.ts
 import { existsSync as existsSync39 } from "fs";
-import { join as join41, relative as relative7 } from "path";
+import { join as join41, relative as relative8 } from "path";
 import { execa as execa9 } from "execa";
 
 // src/lib/codeql-suppression-guard.ts
-import { readdirSync as readdirSync16, readFileSync as readFileSync29, statSync as statSync8 } from "fs";
+import { readdirSync as readdirSync16, readFileSync as readFileSync29, statSync as statSync9 } from "fs";
 import { join as join40 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
@@ -10634,7 +10728,7 @@ function walkSourceFiles(root) {
       const p = join40(dir, entry);
       let st;
       try {
-        st = statSync8(p);
+        st = statSync9(p);
       } catch {
         continue;
       }
@@ -10681,7 +10775,7 @@ async function runCodeqlSuppressionCheck() {
       "\u2717 codeql-suppression guard: found a `codeql[...]`-shaped comment, which does not suppress anything in this repo (#1491) \u2014 dismiss the real alert instead (UI, or `PATCH .../code-scanning/alerts/<n>` with a recorded reason)\n"
     );
     for (const hit of hits) {
-      console.error(`  ${relative7(root, hit.path)}:${hit.line}  ${hit.text.trim()}`);
+      console.error(`  ${relative8(root, hit.path)}:${hit.line}  ${hit.text.trim()}`);
     }
     process.exit(1);
   }
@@ -10696,7 +10790,7 @@ async function runCodeqlSuppressionCheck() {
 import { execa as execa10 } from "execa";
 
 // src/lib/cognito-invite-template-guard.ts
-import { readdirSync as readdirSync17, readFileSync as readFileSync30, statSync as statSync9 } from "fs";
+import { readdirSync as readdirSync17, readFileSync as readFileSync30, statSync as statSync10 } from "fs";
 import { join as join42 } from "path";
 var REQUIRED_INVITE_MEMBERS = ["email_subject", "email_message", "sms_message"];
 var REQUIRED_INVITE_PLACEHOLDERS = ["{username}", "{####}"];
@@ -10771,7 +10865,7 @@ function memberBody(blockBody, member) {
 }
 function findModuleTerraformFiles(repoRoot) {
   const found = [];
-  const walk2 = (dir, relative10) => {
+  const walk2 = (dir, relative11) => {
     let entries;
     try {
       entries = readdirSync17(dir);
@@ -10781,8 +10875,8 @@ function findModuleTerraformFiles(repoRoot) {
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
       const full = join42(dir, entry);
-      const rel = `${relative10}/${entry}`;
-      if (statSync9(full).isDirectory()) {
+      const rel = `${relative11}/${entry}`;
+      if (statSync10(full).isDirectory()) {
         walk2(full, rel);
       } else if (entry.endsWith(".tf")) {
         found.push(rel);
@@ -10826,7 +10920,7 @@ import { join as join44 } from "path";
 import { execa as execa11 } from "execa";
 
 // src/lib/core-direct-paths-audit.ts
-import { existsSync as existsSync40, readFileSync as readFileSync31, readdirSync as readdirSync18, statSync as statSync10 } from "fs";
+import { existsSync as existsSync40, readFileSync as readFileSync31, readdirSync as readdirSync18, statSync as statSync11 } from "fs";
 import { join as join43 } from "path";
 var EXTERNAL_BASE_IDENTIFIERS = ["CORE_API_URL"];
 var API_ROUTE_PREFIX = "/api/v1";
@@ -10994,7 +11088,7 @@ function walkFiles(root, accept, skipDir) {
       const p = join43(dir, entry);
       let st;
       try {
-        st = statSync10(p);
+        st = statSync11(p);
       } catch {
         continue;
       }
@@ -11340,7 +11434,7 @@ ${BOLD}If the divergence is deliberate${OFF}
 import { execa as execa13 } from "execa";
 
 // src/lib/eventbridge-log-permission-guard.ts
-import { readFileSync as readFileSync32, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
+import { readFileSync as readFileSync32, readdirSync as readdirSync19, statSync as statSync12 } from "fs";
 import { join as join45 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
@@ -11421,7 +11515,7 @@ function walkTerraformFiles(root) {
       const p = join45(dir, entry);
       let st;
       try {
-        st = statSync11(p);
+        st = statSync12(p);
       } catch {
         continue;
       }
@@ -11558,7 +11652,7 @@ import { readFileSync as readFileSync34 } from "fs";
 import { join as join47 } from "path";
 
 // src/lib/terraform-input-guard.ts
-import { existsSync as existsSync41, readdirSync as readdirSync20, readFileSync as readFileSync33, statSync as statSync12 } from "fs";
+import { existsSync as existsSync41, readdirSync as readdirSync20, readFileSync as readFileSync33, statSync as statSync13 } from "fs";
 import { join as join46 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
@@ -11583,7 +11677,7 @@ function vendoredPluginServiceDirs(repoRoot) {
   }
   for (const entry of entries) {
     const full = join46(servicesDir, entry);
-    if (!existsSync41(full) || !statSync12(full).isDirectory()) continue;
+    if (!existsSync41(full) || !statSync13(full).isDirectory()) continue;
     if (existsSync41(join46(full, "biffo.plugin.json"))) {
       result.add(entry);
     }
@@ -11593,7 +11687,7 @@ function vendoredPluginServiceDirs(repoRoot) {
 function findWorkflowFiles(repoRoot) {
   const found = [];
   const vendoredPluginDirs = vendoredPluginServiceDirs(repoRoot);
-  const walk2 = (dir, relative10) => {
+  const walk2 = (dir, relative11) => {
     let entries;
     try {
       entries = readdirSync20(dir);
@@ -11602,14 +11696,14 @@ function findWorkflowFiles(repoRoot) {
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
-      if (entry === ".github" && relative10.startsWith("services/") && vendoredPluginDirs.has(relative10.slice("services/".length))) {
+      if (entry === ".github" && relative11.startsWith("services/") && vendoredPluginDirs.has(relative11.slice("services/".length))) {
         continue;
       }
       const full = join46(dir, entry);
-      const rel = relative10 ? `${relative10}/${entry}` : entry;
-      if (statSync12(full).isDirectory()) {
+      const rel = relative11 ? `${relative11}/${entry}` : entry;
+      if (statSync13(full).isDirectory()) {
         walk2(full, rel);
-      } else if (/\.ya?ml$/.test(entry) && relative10.endsWith(".github/workflows")) {
+      } else if (/\.ya?ml$/.test(entry) && relative11.endsWith(".github/workflows")) {
         found.push(rel);
       }
     }
@@ -11736,7 +11830,7 @@ async function runLambdaOutputCheck() {
 
 // src/scripts/check-pipe-trap.ts
 import { readFileSync as readFileSync35, readdirSync as readdirSync21 } from "fs";
-import { join as join48, relative as relative8 } from "path";
+import { join as join48, relative as relative9 } from "path";
 import { execa as execa15 } from "execa";
 
 // src/lib/pipe-trap-guard.ts
@@ -11860,7 +11954,7 @@ async function runPipeTrapCheck() {
   }
   const findings = files.flatMap(
     (file) => findPipeTraps(readFileSync35(file, "utf8")).map(
-      (t) => `${relative8(root, file)}:${t.line}  ${t.text}
+      (t) => `${relative9(root, file)}:${t.line}  ${t.text}
     ${t.reason}`
     )
   );
@@ -11889,11 +11983,11 @@ var PROJECT = "<project>";
 var ENV = "<env>";
 var PLUGIN = "<plugin>";
 var ACCOUNT = "<account>";
-function read(repoRoot, relative10) {
+function read(repoRoot, relative11) {
   try {
-    return readFileSync36(join49(repoRoot, relative10), "utf8");
+    return readFileSync36(join49(repoRoot, relative11), "utf8");
   } catch {
-    throw new Error(`plugin-allowlist drift guard: cannot read ${relative10}`);
+    throw new Error(`plugin-allowlist drift guard: cannot read ${relative11}`);
   }
 }
 function assignedString(source, name) {
@@ -12017,7 +12111,7 @@ import { join as join51 } from "path";
 import { execa as execa17 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync42, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
+import { existsSync as existsSync42, readdirSync as readdirSync22, statSync as statSync14 } from "fs";
 import { join as join50 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
@@ -12026,7 +12120,7 @@ function subdirectories(dir) {
   return readdirSync22(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync13(join50(dir, entry)).isDirectory();
+      return statSync14(join50(dir, entry)).isDirectory();
     } catch {
       return false;
     }
@@ -12107,7 +12201,7 @@ import { execa as execa18 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
 import { existsSync as existsSync44, readFileSync as readFileSync37, readdirSync as readdirSync23 } from "fs";
-import { dirname as dirname10, join as join52, relative as relative9, sep as sep3 } from "path";
+import { dirname as dirname10, join as join52, relative as relative10, sep as sep4 } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -12124,7 +12218,7 @@ function findPluginManifests(root) {
         if (SKIP_DIRS3.has(entry.name)) continue;
         walk2(join52(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative9(root, join52(dir, entry.name)).split(sep3).join("/"));
+        found.push(relative10(root, join52(dir, entry.name)).split(sep4).join("/"));
       }
     }
   };
@@ -12157,7 +12251,7 @@ function checkPluginTerraform(root) {
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
     if (existsSync44(join52(pluginDir2, "terraform"))) continue;
-    const relPluginDir = relative9(root, pluginDir2).split(sep3).join("/");
+    const relPluginDir = relative10(root, pluginDir2).split(sep4).join("/");
     violations.push({
       manifest,
       expectedTerraformDir: relPluginDir ? `${relPluginDir}/terraform` : "terraform",
@@ -12192,7 +12286,7 @@ import { join as join54 } from "path";
 import { execa as execa19 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync45, readFileSync as readFileSync38, readdirSync as readdirSync24, statSync as statSync14 } from "fs";
+import { existsSync as existsSync45, readFileSync as readFileSync38, readdirSync as readdirSync24, statSync as statSync15 } from "fs";
 import { join as join53 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
@@ -12610,7 +12704,7 @@ function listDirs(root) {
   }
   return entries.filter((e) => {
     try {
-      return statSync14(join53(root, e)).isDirectory();
+      return statSync15(join53(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -12629,7 +12723,7 @@ function walkFiles2(root, accept, skipDir) {
       const p = join53(dir, entry);
       let st;
       try {
-        st = statSync14(p);
+        st = statSync15(p);
       } catch {
         continue;
       }
@@ -12998,7 +13092,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync14(join53(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync15(join53(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -13357,7 +13451,7 @@ import { join as join56 } from "path";
 import { execa as execa21 } from "execa";
 
 // src/lib/skeleton-drift-guard.ts
-import { readFileSync as readFileSync39, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
+import { readFileSync as readFileSync39, readdirSync as readdirSync25, statSync as statSync16 } from "fs";
 import { join as join55 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
@@ -13425,7 +13519,7 @@ function walk(dir, base = dir) {
     const abs = join55(dir, entry);
     let isDir;
     try {
-      isDir = statSync15(abs).isDirectory();
+      isDir = statSync16(abs).isDirectory();
     } catch {
       continue;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.283.1",
+  "version": "0.283.3",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",