@biffo/cli 0.289.0 → 0.290.1

package/dist/index.js

@@ -4122,6 +4122,24 @@ function printMigrationBodyDrift(migrations, pairings) {
         "                  The template has changed this migration since you carried it.\n                  An applied migration cannot be re-run, so the carry left yours\n                  alone and this change will NOT reach you."
       )
     );
+    if (d.declared) {
+      console.log(
+        chalk4.dim("                  declared: ") + chalk4.cyan(d.declared.classification) + chalk4.dim(` \u2014 ${d.declared.reason}`)
+      );
+      const handPortText = "- port the body change into your copy by hand";
+      const followOnText = "- ask upstream for a follow-on migration";
+      if (d.declared.classification === "replay-safe") {
+        console.log(chalk4.dim(`                    ${handPortText}`));
+        console.log(
+          chalk4.strikethrough.dim(`                    ${followOnText}`) + chalk4.dim(" (rules out \u2014 replay-safe means your database is already correct)")
+        );
+      } else {
+        console.log(
+          chalk4.strikethrough.dim(`                    ${handPortText}`) + chalk4.dim(" (rules out \u2014 restating this body cannot fix an already-wrong schema)")
+        );
+        console.log(chalk4.dim(`                    ${followOnText}`));
+      }
+    }
   }
   if (pairings.length === 0) {
     console.log(
@@ -11659,8 +11677,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa14("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync45, existsSync: existsSync52 } = await import("fs");
-      if (existsSync52(messageFile)) commitMessage = readFileSync45(messageFile, "utf8");
+      const { readFileSync: readFileSync45, existsSync: existsSync53 } = await import("fs");
+      if (existsSync53(messageFile)) commitMessage = readFileSync45(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -12158,10 +12176,180 @@ async function runLambdaOutputCheck() {
   console.log(`\u2713 Lambda output guard: every aws lambda update-function-* call suppresses output`);
 }
 
+// src/scripts/check-migration-body-change.ts
+import { execa as execa17 } from "execa";
+import { existsSync as existsSync44 } from "fs";
+import { join as join50 } from "path";
+
+// src/lib/migration-body-change-guard.ts
+function checkMigrationBodyChangeMarkers(diffs) {
+  const exemptAdded = [];
+  const unchanged = [];
+  const declared = [];
+  const violations = [];
+  for (const d of diffs) {
+    if (d.status === "added") {
+      exemptAdded.push(d.file);
+      continue;
+    }
+    if (d.status !== "modified") {
+      continue;
+    }
+    const oldHash = migrationBodyHash(d.oldContent ?? "");
+    const newHash = migrationBodyHash(d.newContent ?? "");
+    if (oldHash === newHash) {
+      unchanged.push(d.file);
+      continue;
+    }
+    let decl;
+    try {
+      decl = parseBodyChangeDeclaration(d.newContent ?? "");
+    } catch (err) {
+      violations.push({ file: d.file, reason: err.message });
+      continue;
+    }
+    if (decl) {
+      declared.push({ file: d.file, classification: decl.classification });
+    } else {
+      violations.push({
+        file: d.file,
+        reason: `this edit changes the migration's hashed body (DDL, not just a docstring or comment) with no \`${BODY_CHANGE_MARKER}\` declaration.`
+      });
+    }
+  }
+  return {
+    examined: unchanged.length + declared.length + violations.length,
+    exemptAdded,
+    unchanged,
+    declared,
+    violations
+  };
+}
+
+// src/scripts/check-migration-body-change.ts
+var BOLD2 = "\x1B[1m";
+var DIM2 = "\x1B[2m";
+var RED2 = "\x1B[31m";
+var GREEN = "\x1B[32m";
+var YELLOW2 = "\x1B[33m";
+var OFF2 = "\x1B[0m";
+async function showAt(ref, path, cwd) {
+  const result = await execa17("git", ["show", `${ref}:${path}`], { cwd, reject: false });
+  return result.exitCode === 0 ? result.stdout : null;
+}
+async function runMigrationBodyChangeCheck(argv) {
+  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  if (isInstanceRepo(root)) {
+    console.log(
+      `\u2713 migration body-change guard: skipped \u2014 this is an instance (${INSTANCE_CORE_FILE} present). Its migrations/versions/ is a carried, user-owned copy, not the template source this guard protects.`
+    );
+    return;
+  }
+  if (!existsSync44(join50(root, MIGRATIONS_VERSIONS_DIR))) {
+    console.log(`\u2713 migration body-change guard: no ${MIGRATIONS_VERSIONS_DIR} in this repo.`);
+    return;
+  }
+  const base = process.env["GITHUB_BASE_REF"] ?? argv[0];
+  if (!base) {
+    console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
+    process.exit(2);
+  }
+  await execa17("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa17(
+    "git",
+    [
+      "diff",
+      "--no-renames",
+      "--name-status",
+      `origin/${base}...HEAD`,
+      "--",
+      MIGRATIONS_VERSIONS_DIR
+    ],
+    { cwd: root }
+  );
+  const candidates = [];
+  for (const line of stdout.split("\n")) {
+    const parts = line.split("	").filter(Boolean);
+    const status = parts[0];
+    const path = parts[parts.length - 1];
+    if (!status || !path || parts.length < 2) continue;
+    if (!path.endsWith(".py") || path.endsWith("/__init__.py")) continue;
+    candidates.push({ file: path, status });
+  }
+  const diffs = [];
+  for (const { file, status } of candidates) {
+    if (status.startsWith("A")) {
+      diffs.push({
+        file,
+        status: "added",
+        oldContent: null,
+        newContent: await showAt("HEAD", file, root)
+      });
+    } else if (status.startsWith("M")) {
+      const [oldContent, newContent] = await Promise.all([
+        showAt(`origin/${base}`, file, root),
+        showAt("HEAD", file, root)
+      ]);
+      diffs.push({ file, status: "modified", oldContent, newContent });
+    } else if (status.startsWith("D")) {
+      diffs.push({
+        file,
+        status: "deleted",
+        oldContent: await showAt(`origin/${base}`, file, root),
+        newContent: null
+      });
+    }
+  }
+  const result = checkMigrationBodyChangeMarkers(diffs);
+  console.log(
+    `${DIM2}migration body-change guard: examined ${result.examined} already-released migration file(s) changed in this PR` + (result.exemptAdded.length > 0 ? ` (+${result.exemptAdded.length} newly added, exempt)` : "") + `.${OFF2}`
+  );
+  for (const { file, classification } of result.declared) {
+    console.log(`  ${GREEN}declared${OFF2}   ${file} ${DIM2}\u2192 ${classification}${OFF2}`);
+  }
+  if (result.violations.length === 0) {
+    console.log(`${GREEN}\u2713 migration body-change guard: no undeclared body changes.${OFF2}`);
+    return;
+  }
+  console.error(
+    `
+${RED2}${BOLD2}\u2717 This PR changes an already-released migration's body with no declaration.${OFF2}
+`
+  );
+  for (const { file, reason } of result.violations) {
+    console.error(`  ${RED2}${file}${OFF2}
+    ${DIM2}${reason}${OFF2}`);
+  }
+  console.error(`
+${BOLD2}Why this is blocked${OFF2}
+  An applied migration cannot be re-run, so a body edit here never reaches an
+  instance that already carried it (#739) \u2014 silently, unless a template author
+  says whether that is safe (docs/guides/core-upgrade.md, "When the template
+  edits a migration you already have"). ${YELLOW2}#931${OFF2} shows the safe case: a
+  docstring-only addendum, which this guard never flags, because it compares
+  the same hashed body \`core-upgrade\` itself compares \u2014 DDL, not prose.
+
+${BOLD2}What to do${OFF2}
+  Add a marker to the migration, above or beside the edited DDL:
+
+    ${DIM2}# biffo:body-change: replay-safe \u2014 <why an applied database is already correct>${OFF2}
+    ${DIM2}# biffo:body-change: outcome-changing \u2014 <why an applied database is now wrong>${OFF2}
+
+  Use ${DIM2}replay-safe${OFF2} when re-stating the DDL changes nothing about a database
+  that already ran the old body (a guard, an idempotency check, #670's own
+  fix). Use ${DIM2}outcome-changing${OFF2} when it does not \u2014 an already-applied
+  instance's schema is now actually wrong, and only a follow-on migration
+  converges it. Neither label is enforced yet (#751 is reporting-only, pending
+  more examples) \u2014 but recording it now is what lets that decision be made
+  later instead of never.
+`);
+  process.exit(1);
+}
+
 // src/scripts/check-pipe-trap.ts
 import { readFileSync as readFileSync37, readdirSync as readdirSync22 } from "fs";
-import { join as join50, relative as relative9 } from "path";
-import { execa as execa17 } from "execa";
+import { join as join51, relative as relative9 } from "path";
+import { execa as execa18 } from "execa";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -12257,7 +12445,7 @@ function findPipeTraps(source) {
 function shellFiles(root) {
   const out = [];
   for (const dir of ["scripts", ".githooks"]) {
-    const full = join50(root, dir);
+    const full = join51(root, dir);
     let entries;
     try {
       entries = readdirSync22(full, { withFileTypes: true });
@@ -12267,13 +12455,13 @@ function shellFiles(root) {
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
-      out.push(join50(full, entry.name));
+      out.push(join51(full, entry.name));
     }
   }
   return out;
 }
 async function runPipeTrapCheck() {
-  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = shellFiles(root);
   console.log(`audited ${files.length} shell file(s) under scripts/ and .githooks/ under ${root}`);
   if (files.length === 0) {
@@ -12300,11 +12488,11 @@ async function runPipeTrapCheck() {
 }
 
 // src/scripts/check-plugin-allowlist-convention.ts
-import { execa as execa18 } from "execa";
+import { execa as execa19 } from "execa";
 
 // src/lib/plugin-allowlist-convention.ts
 import { readFileSync as readFileSync38 } from "fs";
-import { join as join51 } from "path";
+import { join as join52 } from "path";
 var COMPUTE_MAIN_TF = "modules/cloud/aws/compute/main.tf";
 var PLUGIN_TEMPLATE_MAIN_TF = "modules/plugins/_template/main.tf";
 var ALLOWLIST_MAIN_TF = "modules/cloud/aws/plugin-allowlist/main.tf";
@@ -12315,7 +12503,7 @@ var PLUGIN = "<plugin>";
 var ACCOUNT = "<account>";
 function read(repoRoot, relative11) {
   try {
-    return readFileSync38(join51(repoRoot, relative11), "utf8");
+    return readFileSync38(join52(repoRoot, relative11), "utf8");
   } catch {
     throw new Error(`plugin-allowlist drift guard: cannot read ${relative11}`);
   }
@@ -12411,7 +12599,7 @@ Plugins would be rejected by require_service_principal (ADR-0009). Fix the glob,
 
 // src/scripts/check-plugin-allowlist-convention.ts
 async function runPluginAllowlistConventionCheck() {
-  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let violations;
   try {
     violations = checkAllowlistConvention(root);
@@ -12436,33 +12624,33 @@ async function runPluginAllowlistConventionCheck() {
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync45 } from "fs";
-import { join as join53 } from "path";
-import { execa as execa19 } from "execa";
+import { existsSync as existsSync46 } from "fs";
+import { join as join54 } from "path";
+import { execa as execa20 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync44, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
-import { join as join52 } from "path";
+import { existsSync as existsSync45, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
+import { join as join53 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync44(dir)) return [];
+  if (!existsSync45(dir)) return [];
   return readdirSync23(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync14(join52(dir, entry)).isDirectory();
+      return statSync14(join53(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync44(join52(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync45(join53(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join52(pluginDir2, "tests");
-  if (!existsSync44(testsDir)) return [];
-  if (existsSync44(join52(testsDir, "__init__.py"))) return [];
+  const testsDir = join53(pluginDir2, "tests");
+  if (!existsSync45(testsDir)) return [];
+  if (existsSync45(join53(testsDir, "__init__.py"))) return [];
   return readdirSync23(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
@@ -12471,7 +12659,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join52(servicesDir, plugin))) {
+      for (const name of namesOf(join53(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -12508,9 +12696,9 @@ function formatCollisions(collisions) {
 
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
-  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join53(root, "services");
-  if (!existsSync45(servicesDir)) {
+  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const servicesDir = join54(root, "services");
+  if (!existsSync46(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -12527,11 +12715,11 @@ async function runPluginCollisionCheck() {
 }
 
 // src/scripts/check-plugin-terraform.ts
-import { execa as execa20 } from "execa";
+import { execa as execa21 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync46, readFileSync as readFileSync39, readdirSync as readdirSync24 } from "fs";
-import { dirname as dirname10, join as join54, relative as relative10, sep as sep4 } from "path";
+import { existsSync as existsSync47, readFileSync as readFileSync39, readdirSync as readdirSync24 } from "fs";
+import { dirname as dirname10, join as join55, relative as relative10, sep as sep4 } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -12546,9 +12734,9 @@ function findPluginManifests(root) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS3.has(entry.name)) continue;
-        walk2(join54(dir, entry.name));
+        walk2(join55(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative10(root, join54(dir, entry.name)).split(sep4).join("/"));
+        found.push(relative10(root, join55(dir, entry.name)).split(sep4).join("/"));
       }
     }
   };
@@ -12573,14 +12761,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync46(join54(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync47(join55(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join54(root, manifest);
+    const absManifest = join55(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
-    if (existsSync46(join54(pluginDir2, "terraform"))) continue;
+    if (existsSync47(join55(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative10(root, pluginDir2).split(sep4).join("/");
     violations.push({
       manifest,
@@ -12600,7 +12788,7 @@ function formatViolations(violations) {
 
 // src/scripts/check-plugin-terraform.ts
 async function runPluginTerraformCheck() {
-  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const violations = checkPluginTerraform(root);
   if (violations.length > 0) {
     console.error("\u2717 plugin Terraform guard: event subscriptions with no infrastructure\n");
@@ -12611,13 +12799,13 @@ async function runPluginTerraformCheck() {
 }
 
 // src/scripts/check-plugin-tool-supply.ts
-import { existsSync as existsSync48 } from "fs";
-import { join as join56 } from "path";
-import { execa as execa21 } from "execa";
+import { existsSync as existsSync49 } from "fs";
+import { join as join57 } from "path";
+import { execa as execa22 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync47, readFileSync as readFileSync40, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
-import { join as join55 } from "path";
+import { existsSync as existsSync48, readFileSync as readFileSync40, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
+import { join as join56 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -13034,7 +13222,7 @@ function listDirs(root) {
   }
   return entries.filter((e) => {
     try {
-      return statSync15(join55(root, e)).isDirectory();
+      return statSync15(join56(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -13050,7 +13238,7 @@ function walkFiles2(root, accept, skipDir) {
       return;
     }
     for (const entry of entries) {
-      const p = join55(dir, entry);
+      const p = join56(dir, entry);
       let st;
       try {
         st = statSync15(p);
@@ -13076,14 +13264,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join55(pluginDir2, "terraform");
+  const tfDir = join56(pluginDir2, "terraform");
   let entries;
   try {
     entries = readdirSync25(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join55(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join56(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -13335,8 +13523,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join55("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join55(
+var CONFIG_PY_PATH = join56("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join56(
   "services",
   "api",
   "src",
@@ -13348,10 +13536,10 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join55(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join55(repoRoot, ORCHESTRATION_SCHEMA_PATH);
-  const configMissing = !existsSync47(configPath);
-  const orchestrationSchemaMissing = !existsSync47(orchestrationPath);
+  const configPath = join56(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join56(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configMissing = !existsSync48(configPath);
+  const orchestrationSchemaMissing = !existsSync48(orchestrationPath);
   const knownSet = new Set(knownModelIds);
   const snapshotEmpty = knownModelIds.length === 0;
   const snapshotStale = isSnapshotStale(snapshotFetchedAt, now);
@@ -13422,7 +13610,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync15(join55(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync15(join56(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -13435,8 +13623,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join55(pluginsRoot, name);
-    const manifestText = readFileSync40(join55(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join56(pluginsRoot, name);
+    const manifestText = readFileSync40(join56(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -13534,7 +13722,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join55(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join56(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -13565,10 +13753,10 @@ function auditPluginToolSupply(pluginsRoot) {
 
 // src/scripts/check-plugin-tool-supply.ts
 async function runPluginToolSupplyCheck() {
-  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa22("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
-  const pluginsRoot = join56(root, "services", "_plugins");
-  if (!existsSync48(pluginsRoot)) {
+  const pluginsRoot = join57(root, "services", "_plugins");
+  if (!existsSync49(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
     const report = auditPluginToolSupply(pluginsRoot);
@@ -13598,8 +13786,8 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join56(root, "services", "api");
-  if (!existsSync48(servicesApiRoot)) {
+  const servicesApiRoot = join57(root, "services", "api");
+  if (!existsSync49(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
     const modelReport = auditDeclaredModelIds(root);
@@ -13645,7 +13833,7 @@ async function runPluginToolSupplyCheck() {
 }
 
 // src/scripts/check-release-subject.ts
-import { execa as execa22 } from "execa";
+import { execa as execa23 } from "execa";
 
 // src/lib/release-version.ts
 var MINOR_TYPES = /* @__PURE__ */ new Set(["feat"]);
@@ -13682,7 +13870,7 @@ async function fetchPrTitleViaGh({
   PR_NUMBER,
   GH_REPO
 }) {
-  const { stdout } = await execa22(
+  const { stdout } = await execa23(
     "gh",
     ["pr", "view", PR_NUMBER, "--repo", GH_REPO, "--json", "title", "--jq", ".title"],
     { env: { ...process.env, GH_TOKEN } }
@@ -13718,7 +13906,7 @@ async function resolveReleaseSubject({
       );
     }
   }
-  return (await execa22("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
+  return (await execa23("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
 }
 async function runReleaseSubjectCheck(argv) {
   const base = process.env["GITHUB_BASE_REF"] ?? argv[0];
@@ -13726,9 +13914,9 @@ async function runReleaseSubjectCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  const root = (await execa22("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  await execa22("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa22("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
+  const root = (await execa23("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  await execa23("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa23("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
     cwd: root
   });
   const changedFiles = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -13979,13 +14167,13 @@ async function runSharedFileReductionCheck(args) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync49, readdirSync as readdirSync27 } from "fs";
-import { join as join58 } from "path";
-import { execa as execa23 } from "execa";
+import { existsSync as existsSync50, readdirSync as readdirSync27 } from "fs";
+import { join as join59 } from "path";
+import { execa as execa24 } from "execa";
 
 // src/lib/skeleton-drift-guard.ts
 import { readFileSync as readFileSync43, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
-import { join as join57 } from "path";
+import { join as join58 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -14049,7 +14237,7 @@ function walk(dir, base = dir) {
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join57(dir, entry);
+    const abs = join58(dir, entry);
     let isDir;
     try {
       isDir = statSync16(abs).isDirectory();
@@ -14071,7 +14259,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync43(join57(skeletonRoot, rel), "utf8");
+        contents = readFileSync43(join58(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -14100,23 +14288,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join58(root, "_skeletons");
+  const skeletonsDir = join59(root, "_skeletons");
   let entries;
   try {
     entries = readdirSync27(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync49(join58(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync50(join59(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
-  const root = (await execa23("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa24("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join58(root, "_skeletons", name);
+    const skeletonRoot = join59(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync49(join58(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync50(join59(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -14130,7 +14318,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join58(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join59(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -14142,9 +14330,9 @@ async function runSkeletonDriftCheck() {
 }
 
 // src/scripts/check-terraform-input.ts
-import { execa as execa24 } from "execa";
+import { execa as execa25 } from "execa";
 async function runTerraformInputCheck() {
-  const root = (await execa24("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa25("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -14167,11 +14355,16 @@ async function runTerraformInputCheck() {
 
 // src/commands/check.ts
 var checkCommand = new Command24("check").description(
-  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input, plugin-allowlist-convention) run in CI and git hooks, plus out-of-band audits (branch protection, plugin-staleness)"
+  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input, plugin-allowlist-convention, migration-body-change) run in CI and git hooks, plus out-of-band audits (branch protection, plugin-staleness)"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
   await runOwnershipCheck(rawArgsAfter("ownership"));
 });
+checkCommand.command("migration-body-change").description(
+  "Refuse a PR that changes an already-released migration's HASHED body (DDL, not a docstring or comment) with no `# biffo:body-change:` marker (#751) \u2014 mirrors migrationBodyHash's normalisation, so a docstring-only edit (#931) stays silent. Reporting-only classification, not enforcement: this only requires the marker exist, it does not act on what it declares."
+).argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").action(async () => {
+  await runMigrationBodyChangeCheck(rawArgsAfter("migration-body-change"));
+});
 checkCommand.command("release-subject").description("Require a Conventional Commits PR title on template-owned changes (#423)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").action(async () => {
   await runReleaseSubjectCheck(rawArgsAfter("release-subject"));
 });
@@ -14280,8 +14473,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync50, readFileSync as readFileSync44 } from "fs";
-import { join as join59, resolve as resolve20 } from "path";
+import { existsSync as existsSync51, readFileSync as readFileSync44 } from "fs";
+import { join as join60, resolve as resolve20 } from "path";
 import chalk21 from "chalk";
 import { Command as Command25 } from "commander";
 
@@ -14460,8 +14653,8 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
   return runDoctorChecks(facts);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join59(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync50(path)) return null;
+  const path = join60(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync51(path)) return null;
   try {
     return extractVersionField(readFileSync44(path, "utf8"));
   } catch {
@@ -14483,8 +14676,8 @@ function extractVersionField(contents) {
   return match?.[1] ?? null;
 }
 function readFossil(cwd) {
-  const path = join59(cwd, CORE_VERSION_FILE);
-  if (!existsSync50(path)) return null;
+  const path = join60(cwd, CORE_VERSION_FILE);
+  if (!existsSync51(path)) return null;
   try {
     const value = readFileSync44(path, "utf8").trim();
     return value === "" ? null : value;
@@ -14935,13 +15128,13 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command27 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync51 } from "fs";
-import { dirname as dirname11, join as join60 } from "path";
+import { existsSync as existsSync52 } from "fs";
+import { dirname as dirname11, join as join61 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join60(dir, relativePath);
-    if (existsSync51(candidate)) return candidate;
+    const candidate = join61(dir, relativePath);
+    if (existsSync52(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.289.0",
+  "version": "0.290.1",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",