@biffo/cli 0.283.3 → 0.283.4

package/dist/index.js

@@ -9693,6 +9693,7 @@ import { cpSync as cpSync6, existsSync as existsSync35, mkdirSync as mkdirSync12
 import { join as join37, relative as relative7, resolve as resolve17 } from "path";
 import chalk19 from "chalk";
 import { Command as Command20 } from "commander";
+import { execa as execa7 } from "execa";
 import inquirer7 from "inquirer";
 var pluginUpgradeCommand = new Command20("upgrade").description(
   "Upgrade an installed plugin to a new minor version (biffo plugin upgrade <name>@<new-minor>) or refresh it in place from a local, unpublished checkout (biffo plugin upgrade --local <path>)"
@@ -9794,6 +9795,7 @@ async function runPluginUpgrade(target, options, deps) {
       refuseIfModuleStillReferenced(options.cwd, modulesDir, entry.name);
     }
     const previousProvenance = readProvenance(targetDir);
+    const previousPyproject = readPyprojectIfPresent(targetDir);
     rmSync10(targetDir, { recursive: true, force: true });
     mkdirSync12(targetDir, { recursive: true });
     cpSync6(tmpDir, targetDir, { recursive: true });
@@ -9804,6 +9806,7 @@ async function runPluginUpgrade(target, options, deps) {
     );
     writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, `services/${entry.name}`);
+    const newPyproject = readPyprojectIfPresent(targetDir);
     const stagePaths = [`services/${entry.name}`];
     if (existsSync35(modulesDir)) {
       rmSync10(modulesDir, { recursive: true, force: true });
@@ -9835,12 +9838,29 @@ async function runPluginUpgrade(target, options, deps) {
     if (seedResult.vendored) {
       stagePaths.push(seedResult.stagedPath);
     }
+    const lockOutcomes = await relockIfDependenciesChanged(
+      options.cwd,
+      `services/${entry.name}/pyproject.toml`,
+      previousPyproject,
+      newPyproject,
+      deps
+    );
+    for (const outcome of lockOutcomes) {
+      if (outcome.ok) stagePaths.push(outcome.trigger.lockfile);
+    }
     const label = currentVersion ? `${entry.name} ${currentVersion} -> ${entry.version}` : `${entry.name} to ${entry.version}`;
     const commitMessage = `feat(plugins): upgrade ${label}`;
     await deps.git.add(options.cwd, stagePaths);
     await deps.git.commit(options.cwd, commitMessage);
     log.success(`Committed: ${commitMessage}`);
-    console.log(chalk19.bold("\n  Plugin upgraded!\n"));
+    const lockFailures = describeFailures(lockOutcomes);
+    if (lockFailures.length > 0) {
+      console.log(chalk19.yellow.bold("\n  \u26A0 Plugin upgraded, but uv.lock needs attention\n"));
+      for (const failure of lockFailures) console.log(chalk19.yellow(`  ${failure}`));
+      console.log();
+    } else {
+      console.log(chalk19.bold("\n  Plugin upgraded!\n"));
+    }
     console.log(`  ${entry.name}@${entry.version} is committed at services/${entry.name}/`);
     console.log("  Push and redeploy to apply its updated tables and routes:");
     console.log(chalk19.dim(`    git push`));
@@ -9889,6 +9909,7 @@ async function runLocalPluginRefresh(localPath, options, deps) {
       refuseIfModuleStillReferenced(options.cwd, modulesDir, source.name);
     }
     const previousProvenance = readProvenance(targetDir);
+    const previousPyproject = readPyprojectIfPresent(targetDir);
     if (inTreeSource) {
       log.info(
         `services/${source.name}/ is already the local checkout \u2014 nothing to copy; re-syncing its Terraform module and checking for a migration.`
@@ -9902,6 +9923,7 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     const nextProvenance = inTreeSource ? inTreePluginProvenance(`services/${source.name}`) : await resolveLocalProvenance(source.sourceDir, source.origin);
     writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, `services/${source.name}`);
+    const newPyproject = readPyprojectIfPresent(targetDir);
     const stagePaths = [`services/${source.name}`];
     if (existsSync35(modulesDir)) {
       rmSync10(modulesDir, { recursive: true, force: true });
@@ -9935,6 +9957,16 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     if (seedResult.vendored) {
       stagePaths.push(seedResult.stagedPath);
     }
+    const lockOutcomes = await relockIfDependenciesChanged(
+      options.cwd,
+      `services/${source.name}/pyproject.toml`,
+      previousPyproject,
+      newPyproject,
+      deps
+    );
+    for (const outcome of lockOutcomes) {
+      if (outcome.ok) stagePaths.push(outcome.trigger.lockfile);
+    }
     await deps.git.add(options.cwd, stagePaths);
     if (!await deps.git.hasUncommittedChanges(options.cwd)) {
       log.warn(`services/${source.name}/ already matches ${source.origin} \u2014 nothing to commit.`);
@@ -9943,7 +9975,14 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     const commitMessage = `chore(plugins): refresh ${source.name} from local checkout`;
     await deps.git.commit(options.cwd, commitMessage);
     log.success(`Committed: ${commitMessage}`);
-    console.log(chalk19.bold("\n  Plugin refreshed!\n"));
+    const lockFailures = describeFailures(lockOutcomes);
+    if (lockFailures.length > 0) {
+      console.log(chalk19.yellow.bold("\n  \u26A0 Plugin refreshed, but uv.lock needs attention\n"));
+      for (const failure of lockFailures) console.log(chalk19.yellow(`  ${failure}`));
+      console.log();
+    } else {
+      console.log(chalk19.bold("\n  Plugin refreshed!\n"));
+    }
     console.log(`  services/${source.name}/ now matches ${source.origin}`);
     console.log("  Push and redeploy to apply any updated tables and routes:");
     console.log(chalk19.dim(`    git push`));
@@ -9964,6 +10003,62 @@ ${refList}
 A plugin repo without terraform/ is missing the directory, not declaring that the module should go, and a wrong destructive action here is worse than no action. Either remove the reference(s) above yourself, or run 'biffo plugin uninstall ${name}', which removes the module and unwires the reference together.`
   );
 }
+async function relockIfDependenciesChanged(cwd, relPyprojectPath, previousPyproject, newPyproject, deps) {
+  if (!dependenciesChanged(previousPyproject, newPyproject)) return [];
+  const triggers = lockfilesNeedingRefresh([relPyprojectPath], cwd);
+  if (triggers.length === 0) return [];
+  const run = deps.runCommand ?? defaultRunCommand2;
+  const outcomes = await refreshLockfiles(cwd, triggers, run);
+  const refreshed = outcomes.filter((o) => o.ok);
+  if (refreshed.length > 0) {
+    log.success(
+      `Refreshed ${refreshed.map((o) => o.trigger.lockfile).join(", ")} \u2014 this refresh changed a dependency it locks.`
+    );
+  }
+  for (const message of describeFailures(outcomes)) log.warn(message);
+  return outcomes;
+}
+var defaultRunCommand2 = async (command, cwd) => {
+  const [bin, ...args] = command;
+  if (!bin) return { ok: false, error: "empty command" };
+  try {
+    await execa7(bin, args, { cwd });
+    return { ok: true };
+  } catch (err) {
+    const cause = err;
+    const detail = cause.stderr?.trim() || cause.shortMessage || cause.message || "failed";
+    return { ok: false, error: detail.split("\n")[0] ?? "failed" };
+  }
+};
+function readPyprojectIfPresent(targetDir) {
+  const path = join37(targetDir, "pyproject.toml");
+  return existsSync35(path) ? readFileSync26(path, "utf8") : null;
+}
+function dependenciesChanged(before, after) {
+  if (before === after) return false;
+  const beforeItems = before ? dependencySurface(before) : [];
+  const afterItems = after ? dependencySurface(after) : [];
+  return JSON.stringify(beforeItems) !== JSON.stringify(afterItems);
+}
+function dependencySurface(text) {
+  const items = [...readTomlStringArray(text, "dependencies")];
+  for (const header of ["dependency-groups", "project.optional-dependencies"]) {
+    const body = tomlTableBody(text, header);
+    if (!body) continue;
+    for (const m of body.matchAll(/^([A-Za-z0-9_.-]+)\s*=\s*\[/gm)) {
+      items.push(...readTomlStringArray(body, m[1]));
+    }
+  }
+  return items.sort();
+}
+function tomlTableBody(text, header) {
+  const escaped = header.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const headerMatch = new RegExp(`^\\[${escaped}\\]\\s*$`, "m").exec(text);
+  if (!headerMatch) return null;
+  const rest = text.slice(headerMatch.index + headerMatch[0].length);
+  const nextHeader = /^\[/m.exec(rest);
+  return nextHeader ? rest.slice(0, nextHeader.index) : rest;
+}
 function readInstalledVersion2(targetDir) {
   const manifestPath = join37(targetDir, "biffo.plugin.json");
   if (!existsSync35(manifestPath)) return void 0;
@@ -10314,7 +10409,7 @@ import { Command as Command24 } from "commander";
 // src/scripts/check-adr-numbering.ts
 import { existsSync as existsSync38 } from "fs";
 import { join as join39 } from "path";
-import { execa as execa7 } from "execa";
+import { execa as execa8 } from "execa";
 
 // src/lib/adr-numbering-guard.ts
 import { existsSync as existsSync37, readdirSync as readdirSync15, readFileSync as readFileSync28 } from "fs";
@@ -10388,7 +10483,7 @@ function formatAdrReservedRangeViolations(violations, reservedUpTo = TEMPLATE_AD
 
 // src/scripts/check-adr-numbering.ts
 async function runAdrNumberingCheck() {
-  const root = (await execa7("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const adrDir = join39(root, "docs", "ADR");
   if (!existsSync38(adrDir)) {
     console.log("\u2713 ADR numbering guard: no docs/ADR/ directory \u2014 nothing to compare");
@@ -10429,7 +10524,7 @@ Already accepted? List it in docs/ADR/${ALLOWLIST_FILENAME} instead of leaving t
 
 // src/scripts/check-branch-protection.ts
 import { Octokit as Octokit2 } from "@octokit/rest";
-import { execa as execa8 } from "execa";
+import { execa as execa9 } from "execa";
 
 // src/lib/branch-protection-apply.ts
 var CONTEXT_CONSISTENCY_THRESHOLD = 2 / 3;
@@ -10556,7 +10651,7 @@ async function resolveRepo(explicit) {
     }
     return { owner, repo };
   }
-  const { stdout } = await execa8("git", ["remote", "get-url", "origin"]);
+  const { stdout } = await execa9("git", ["remote", "get-url", "origin"]);
   const m = /github\.com[:/]([^/]+)\/(.+?)(?:\.git)?$/.exec(stdout.trim());
   if (!m?.[1] || !m[2]) {
     console.error(
@@ -10690,7 +10785,7 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
 // src/scripts/check-codeql-suppression.ts
 import { existsSync as existsSync39 } from "fs";
 import { join as join41, relative as relative8 } from "path";
-import { execa as execa9 } from "execa";
+import { execa as execa10 } from "execa";
 
 // src/lib/codeql-suppression-guard.ts
 import { readdirSync as readdirSync16, readFileSync as readFileSync29, statSync as statSync9 } from "fs";
@@ -10761,7 +10856,7 @@ function sweepCodeqlSuppressionComments(root) {
 
 // src/scripts/check-codeql-suppression.ts
 async function runCodeqlSuppressionCheck() {
-  const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const scanRoot = join41(root, "cli", "src");
   if (!existsSync39(scanRoot)) {
     console.log(
@@ -10787,7 +10882,7 @@ async function runCodeqlSuppressionCheck() {
 }
 
 // src/scripts/check-cognito-invite-template.ts
-import { execa as execa10 } from "execa";
+import { execa as execa11 } from "execa";
 
 // src/lib/cognito-invite-template-guard.ts
 import { readdirSync as readdirSync17, readFileSync as readFileSync30, statSync as statSync10 } from "fs";
@@ -10894,7 +10989,7 @@ function checkCognitoInviteTemplates(repoRoot) {
 
 // src/scripts/check-cognito-invite-template.ts
 async function runCognitoInviteTemplateCheck() {
-  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findModuleTerraformFiles(root);
   console.log(`audited ${files.length} .tf file(s) under modules/ under ${root}`);
   if (files.length === 0) {
@@ -10917,7 +11012,7 @@ async function runCognitoInviteTemplateCheck() {
 
 // src/scripts/check-core-direct-paths.ts
 import { join as join44 } from "path";
-import { execa as execa11 } from "execa";
+import { execa as execa12 } from "execa";
 
 // src/lib/core-direct-paths-audit.ts
 import { existsSync as existsSync40, readFileSync as readFileSync31, readdirSync as readdirSync18, statSync as statSync11 } from "fs";
@@ -11245,7 +11340,7 @@ function auditSiblingCoreDirectPaths(params) {
 
 // src/scripts/check-core-direct-paths.ts
 async function runCoreDirectPathsCheck(opts = {}) {
-  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const sibling = opts.sibling ?? "sibling-template (self-check)";
   const frontendSrcDir = opts.frontendSrc ?? join44(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
   let coreApiSrcDir;
@@ -11299,7 +11394,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
 }
 
 // src/scripts/check-core-ownership.ts
-import { execa as execa12 } from "execa";
+import { execa as execa13 } from "execa";
 var BOLD = "\x1B[1m";
 var DIM = "\x1B[2m";
 var RED = "\x1B[31m";
@@ -11310,7 +11405,7 @@ async function runOwnershipCheck(argv) {
   const stagedFlag = args.indexOf("--staged");
   const staged = stagedFlag !== -1;
   const messageFile = staged ? args[stagedFlag + 1] : void 0;
-  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const ownership = classifyRepoOwnership(root);
   if (ownership === "template") {
     console.log("\u2713 core ownership guard: skipped \u2014 this is the template, which owns these paths.");
@@ -11326,7 +11421,7 @@ async function runOwnershipCheck(argv) {
   let deletedFiles = [];
   let commitMessage = "";
   if (staged) {
-    const { stdout } = await execa12("git", ["diff", "--cached", "--name-status"], { cwd: root });
+    const { stdout } = await execa13("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
       const { readFileSync: readFileSync41, existsSync: existsSync50 } = await import("fs");
@@ -11338,18 +11433,18 @@ async function runOwnershipCheck(argv) {
       console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
       process.exit(2);
     }
-    await execa12("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-    const { stdout } = await execa12("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
+    await execa13("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+    const { stdout } = await execa13("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
       cwd: root
     });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
-    const { stdout: log2 } = await execa12("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
+    const { stdout: log2 } = await execa13("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
       cwd: root,
       reject: false
     });
     commitMessage = log2;
   }
-  const { stdout: gitBranch } = await execa12("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+  const { stdout: gitBranch } = await execa13("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
     cwd: root,
     reject: false
   });
@@ -11431,7 +11526,7 @@ ${BOLD}If the divergence is deliberate${OFF}
 }
 
 // src/scripts/check-eventbridge-log-permissions.ts
-import { execa as execa13 } from "execa";
+import { execa as execa14 } from "execa";
 
 // src/lib/eventbridge-log-permission-guard.ts
 import { readFileSync as readFileSync32, readdirSync as readdirSync19, statSync as statSync12 } from "fs";
@@ -11608,7 +11703,7 @@ function auditEventBridgeLogPermissions(root) {
 
 // src/scripts/check-eventbridge-log-permissions.ts
 async function runEventBridgeLogPermissionCheck() {
-  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let report;
   try {
     report = auditEventBridgeLogPermissions(root);
@@ -11645,7 +11740,7 @@ async function runEventBridgeLogPermissionCheck() {
 }
 
 // src/scripts/check-lambda-output.ts
-import { execa as execa14 } from "execa";
+import { execa as execa15 } from "execa";
 
 // src/lib/lambda-output-guard.ts
 import { readFileSync as readFileSync34 } from "fs";
@@ -11807,7 +11902,7 @@ function checkLambdaOutput(repoRoot) {
 
 // src/scripts/check-lambda-output.ts
 async function runLambdaOutputCheck() {
-  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -11831,7 +11926,7 @@ async function runLambdaOutputCheck() {
 // src/scripts/check-pipe-trap.ts
 import { readFileSync as readFileSync35, readdirSync as readdirSync21 } from "fs";
 import { join as join48, relative as relative9 } from "path";
-import { execa as execa15 } from "execa";
+import { execa as execa16 } from "execa";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -11943,7 +12038,7 @@ function shellFiles(root) {
   return out;
 }
 async function runPipeTrapCheck() {
-  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = shellFiles(root);
   console.log(`audited ${files.length} shell file(s) under scripts/ and .githooks/ under ${root}`);
   if (files.length === 0) {
@@ -11970,7 +12065,7 @@ async function runPipeTrapCheck() {
 }
 
 // src/scripts/check-plugin-allowlist-convention.ts
-import { execa as execa16 } from "execa";
+import { execa as execa17 } from "execa";
 
 // src/lib/plugin-allowlist-convention.ts
 import { readFileSync as readFileSync36 } from "fs";
@@ -12081,7 +12176,7 @@ Plugins would be rejected by require_service_principal (ADR-0009). Fix the glob,
 
 // src/scripts/check-plugin-allowlist-convention.ts
 async function runPluginAllowlistConventionCheck() {
-  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let violations;
   try {
     violations = checkAllowlistConvention(root);
@@ -12108,7 +12203,7 @@ async function runPluginAllowlistConventionCheck() {
 // src/scripts/check-plugin-collisions.ts
 import { existsSync as existsSync43 } from "fs";
 import { join as join51 } from "path";
-import { execa as execa17 } from "execa";
+import { execa as execa18 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
 import { existsSync as existsSync42, readdirSync as readdirSync22, statSync as statSync14 } from "fs";
@@ -12178,7 +12273,7 @@ function formatCollisions(collisions) {
 
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
-  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const servicesDir = join51(root, "services");
   if (!existsSync43(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
@@ -12197,7 +12292,7 @@ async function runPluginCollisionCheck() {
 }
 
 // src/scripts/check-plugin-terraform.ts
-import { execa as execa18 } from "execa";
+import { execa as execa19 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
 import { existsSync as existsSync44, readFileSync as readFileSync37, readdirSync as readdirSync23 } from "fs";
@@ -12270,7 +12365,7 @@ function formatViolations(violations) {
 
 // src/scripts/check-plugin-terraform.ts
 async function runPluginTerraformCheck() {
-  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const violations = checkPluginTerraform(root);
   if (violations.length > 0) {
     console.error("\u2717 plugin Terraform guard: event subscriptions with no infrastructure\n");
@@ -12283,7 +12378,7 @@ async function runPluginTerraformCheck() {
 // src/scripts/check-plugin-tool-supply.ts
 import { existsSync as existsSync46 } from "fs";
 import { join as join54 } from "path";
-import { execa as execa19 } from "execa";
+import { execa as execa20 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
 import { existsSync as existsSync45, readFileSync as readFileSync38, readdirSync as readdirSync24, statSync as statSync15 } from "fs";
@@ -13235,7 +13330,7 @@ function auditPluginToolSupply(pluginsRoot) {
 
 // src/scripts/check-plugin-tool-supply.ts
 async function runPluginToolSupplyCheck() {
-  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
   const pluginsRoot = join54(root, "services", "_plugins");
   if (!existsSync46(pluginsRoot)) {
@@ -13315,7 +13410,7 @@ async function runPluginToolSupplyCheck() {
 }
 
 // src/scripts/check-release-subject.ts
-import { execa as execa20 } from "execa";
+import { execa as execa21 } from "execa";
 
 // src/lib/release-version.ts
 var MINOR_TYPES = /* @__PURE__ */ new Set(["feat"]);
@@ -13352,7 +13447,7 @@ async function fetchPrTitleViaGh({
   PR_NUMBER,
   GH_REPO
 }) {
-  const { stdout } = await execa20(
+  const { stdout } = await execa21(
     "gh",
     ["pr", "view", PR_NUMBER, "--repo", GH_REPO, "--json", "title", "--jq", ".title"],
     { env: { ...process.env, GH_TOKEN } }
@@ -13388,7 +13483,7 @@ async function resolveReleaseSubject({
       );
     }
   }
-  return (await execa20("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
+  return (await execa21("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
 }
 async function runReleaseSubjectCheck(argv) {
   const base = process.env["GITHUB_BASE_REF"] ?? argv[0];
@@ -13396,9 +13491,9 @@ async function runReleaseSubjectCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  await execa20("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa20("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
+  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  await execa21("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa21("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
     cwd: root
   });
   const changedFiles = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -13448,7 +13543,7 @@ async function runReleaseSubjectCheck(argv) {
 // src/scripts/check-skeleton-drift.ts
 import { existsSync as existsSync47, readdirSync as readdirSync26 } from "fs";
 import { join as join56 } from "path";
-import { execa as execa21 } from "execa";
+import { execa as execa22 } from "execa";
 
 // src/lib/skeleton-drift-guard.ts
 import { readFileSync as readFileSync39, readdirSync as readdirSync25, statSync as statSync16 } from "fs";
@@ -13577,7 +13672,7 @@ function discoverSkeletons(root) {
   return entries.filter((name) => existsSync47(join56(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
-  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa22("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
@@ -13609,9 +13704,9 @@ async function runSkeletonDriftCheck() {
 }
 
 // src/scripts/check-terraform-input.ts
-import { execa as execa22 } from "execa";
+import { execa as execa23 } from "execa";
 async function runTerraformInputCheck() {
-  const root = (await execa22("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa23("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.283.3",
+  "version": "0.283.4",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",