@biffo/cli 0.296.17 → 0.297.1

package/dist/index.js

@@ -573,7 +573,25 @@ import { execSync as execSync2 } from "child_process";
 import { existsSync as existsSync15, rmSync as rmSync5 } from "fs";
 import { join as join16, resolve as resolve3 } from "path";
 import chalk4 from "chalk";
-import { execa as execa3 } from "execa";
+
+// src/lib/exec.ts
+import { execa as rawExeca } from "execa";
+var execTimeoutMs = () => {
+  const raw = process.env.BIFFO_EXEC_TIMEOUT_MS;
+  const parsed = raw === void 0 ? Number.NaN : Number(raw);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 9e5;
+};
+var execa = (file, args, options) => {
+  const opts = options ?? {};
+  const supplied = "stdin" in opts || "input" in opts;
+  return rawExeca(file, args ?? [], {
+    ...supplied ? {} : { stdin: "ignore" },
+    timeout: execTimeoutMs(),
+    ...opts
+  });
+};
+
+// src/commands/core-upgrade.ts
 import { Command as Command3 } from "commander";
 
 // src/adapters/git/index.ts
@@ -581,7 +599,6 @@ import { randomUUID } from "crypto";
 import { existsSync as existsSync6, mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { join as join6 } from "path";
-import { execa as execa2 } from "execa";
 
 // src/lib/core-upgrade.ts
 import { isUtf8 } from "buffer";
@@ -597,7 +614,6 @@ import {
 } from "fs";
 import { tmpdir } from "os";
 import { dirname as dirname3, join as join5 } from "path";
-import { execa } from "execa";
 import { z as z4 } from "zod";
 
 // src/lib/core-ownership-guard.ts
@@ -953,7 +969,7 @@ var GitAdapter = class {
   async configuredIdentity(cwd) {
     const read2 = async (key) => {
       try {
-        const { stdout } = await execa2("git", ["config", "--get", key], cwd ? { cwd } : {});
+        const { stdout } = await execa("git", ["config", "--get", key], cwd ? { cwd } : {});
         return stdout.trim() || null;
       } catch {
         return null;
@@ -963,7 +979,7 @@ var GitAdapter = class {
   }
   async isGitRepo(cwd) {
     try {
-      await execa2("git", ["rev-parse", "--is-inside-work-tree"], { cwd });
+      await execa("git", ["rev-parse", "--is-inside-work-tree"], { cwd });
       return true;
     } catch {
       return false;
@@ -988,7 +1004,7 @@ var GitAdapter = class {
     const dir = mkdtempSync2(join6(tmpdir2(), `${namePrefix}-${randomUUID().slice(0, 8)}-`));
     const cloneUrl = token ? injectToken(repoUrl, token) : repoUrl;
     try {
-      await execa2("git", ["clone", "--depth", "1", cloneUrl, dir]);
+      await execa("git", ["clone", "--depth", "1", cloneUrl, dir]);
     } catch (err) {
       rmSync2(dir, { recursive: true, force: true });
       throw gitFailure(`Failed to clone ${repoUrl}`, err, [token]);
@@ -1011,7 +1027,7 @@ var GitAdapter = class {
     const dir = mkdtempSync2(join6(tmpdir2(), `${namePrefix}-${randomUUID().slice(0, 8)}-`));
     const cloneUrl = token ? injectToken(repoUrl, token) : repoUrl;
     try {
-      await execa2("git", ["clone", cloneUrl, dir]);
+      await execa("git", ["clone", cloneUrl, dir]);
     } catch (err) {
       rmSync2(dir, { recursive: true, force: true });
       throw gitFailure(`Failed to clone ${repoUrl}`, err, [token]);
@@ -1035,26 +1051,26 @@ var GitAdapter = class {
    * repo uses (#559).
    */
   async init(cwd, initialBranch = "dev") {
-    await execa2("git", ["init", "-b", initialBranch], { cwd });
+    await execa("git", ["init", "-b", initialBranch], { cwd });
   }
   /** Adds a remote. Fails if a remote with this name already exists. */
   async addRemote(cwd, name, url) {
-    await execa2("git", ["remote", "add", name, url], { cwd });
+    await execa("git", ["remote", "add", name, url], { cwd });
   }
   async add(cwd, paths) {
-    await execa2("git", ["add", ...paths], { cwd });
+    await execa("git", ["add", ...paths], { cwd });
   }
   async commit(cwd, message) {
-    await execa2("git", ["commit", "-m", message], { cwd });
+    await execa("git", ["commit", "-m", message], { cwd });
   }
   /** The current branch name (e.g. "dev"). */
   async currentBranch(cwd) {
-    const { stdout } = await execa2("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd });
+    const { stdout } = await execa("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd });
     return stdout.trim();
   }
   /** True if the working tree or index has uncommitted changes. */
   async hasUncommittedChanges(cwd) {
-    const { stdout } = await execa2("git", ["status", "--porcelain"], { cwd });
+    const { stdout } = await execa("git", ["status", "--porcelain"], { cwd });
     return stdout.trim().length > 0;
   }
   /** Best-effort fetch of the tracking remote, so the ahead/behind check below
@@ -1062,13 +1078,13 @@ var GitAdapter = class {
    * offline or a missing remote must not block an upgrade on its own — the
    * ahead/behind check that follows simply works from whatever is local. */
   async fetch(cwd, remote = "origin") {
-    await execa2("git", ["fetch", "--quiet", remote], { cwd, reject: false });
+    await execa("git", ["fetch", "--quiet", remote], { cwd, reject: false });
   }
   /** HEAD's position relative to its upstream. `hasUpstream` is false when the
    * branch tracks nothing (or HEAD is detached), in which case currency cannot
    * be established and ahead/behind are 0 (#394). */
   async aheadBehind(cwd) {
-    const { stdout, exitCode } = await execa2(
+    const { stdout, exitCode } = await execa(
       "git",
       ["rev-list", "--left-right", "--count", "HEAD...@{upstream}"],
       { cwd, reject: false }
@@ -1079,7 +1095,7 @@ var GitAdapter = class {
   }
   /** The fetch URL of a remote (default "origin"). */
   async getRemoteUrl(cwd, remote = "origin") {
-    const { stdout } = await execa2("git", ["remote", "get-url", remote], { cwd });
+    const { stdout } = await execa("git", ["remote", "get-url", remote], { cwd });
     return stdout.trim();
   }
   /**
@@ -1092,7 +1108,7 @@ var GitAdapter = class {
    * SHA as an honest "could not determine", never as license to invent one.
    */
   async resolveDefaultBranchSha(repoUrl) {
-    const { stdout, exitCode } = await execa2("git", ["ls-remote", "--exit-code", repoUrl, "HEAD"], {
+    const { stdout, exitCode } = await execa("git", ["ls-remote", "--exit-code", repoUrl, "HEAD"], {
       reject: false
     });
     if (exitCode !== 0) return null;
@@ -1110,7 +1126,7 @@ var GitAdapter = class {
    * equally best-effort call.
    */
   async fetchPrune(cwd, remote = "origin") {
-    await execa2("git", ["fetch", "--quiet", "--prune", remote], { cwd, reject: false });
+    await execa("git", ["fetch", "--quiet", "--prune", remote], { cwd, reject: false });
   }
   /**
    * Is `cwd` the primary checkout, rather than a linked worktree?
@@ -1127,8 +1143,8 @@ var GitAdapter = class {
   async isPrimaryWorktree(cwd) {
     const opts = { cwd, reject: false };
     const [dir, common] = await Promise.all([
-      execa2("git", ["rev-parse", "--absolute-git-dir"], opts),
-      execa2("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], opts)
+      execa("git", ["rev-parse", "--absolute-git-dir"], opts),
+      execa("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], opts)
     ]);
     if (dir.exitCode !== 0 || common.exitCode !== 0) return true;
     return dir.stdout.trim() === common.stdout.trim();
@@ -1140,7 +1156,7 @@ var GitAdapter = class {
    * annotations vary, and this has to survive paths with spaces.
    */
   async listWorktrees(cwd) {
-    const { stdout, exitCode } = await execa2("git", ["worktree", "list", "--porcelain"], {
+    const { stdout, exitCode } = await execa("git", ["worktree", "list", "--porcelain"], {
       cwd,
       reject: false
     });
@@ -1158,7 +1174,7 @@ var GitAdapter = class {
   }
   /** How many commits `branch` is behind `base`; null when it cannot be measured. */
   async countBehind(cwd, branch, base) {
-    const { stdout, exitCode } = await execa2("git", ["rev-list", "--count", `${branch}..${base}`], {
+    const { stdout, exitCode } = await execa("git", ["rev-list", "--count", `${branch}..${base}`], {
       cwd,
       reject: false
     });
@@ -1168,7 +1184,7 @@ var GitAdapter = class {
   }
   /** A file's contents at a ref, or null when it is absent there. */
   async showFileAtRef(cwd, ref, path) {
-    const { stdout, exitCode } = await execa2("git", ["show", `${ref}:${path}`], {
+    const { stdout, exitCode } = await execa("git", ["show", `${ref}:${path}`], {
       cwd,
       reject: false
     });
@@ -1176,7 +1192,7 @@ var GitAdapter = class {
   }
   /** Every local branch with its upstream and tracking state (#758). */
   async listBranchRefs(cwd) {
-    const { stdout, exitCode } = await execa2(
+    const { stdout, exitCode } = await execa(
       "git",
       ["for-each-ref", `--format=${BRANCH_REF_FORMAT}`, "refs/heads"],
       { cwd, reject: false }
@@ -1194,12 +1210,12 @@ var GitAdapter = class {
    * passes branches whose upstream git reports as gone.
    */
   async deleteBranch(cwd, branch) {
-    const { exitCode } = await execa2("git", ["branch", "-D", branch], { cwd, reject: false });
+    const { exitCode } = await execa("git", ["branch", "-D", branch], { cwd, reject: false });
     return exitCode === 0;
   }
   /** Create and switch to a new branch. Fails if it already exists. */
   async createBranch(cwd, branch) {
-    await execa2("git", ["switch", "-c", branch], { cwd });
+    await execa("git", ["switch", "-c", branch], { cwd });
   }
   /**
    * Switch to an existing branch. Fails if it does not exist, and — deliberately
@@ -1208,7 +1224,7 @@ var GitAdapter = class {
    * putting back.
    */
   async switchBranch(cwd, branch) {
-    await execa2("git", ["switch", branch], { cwd });
+    await execa("git", ["switch", branch], { cwd });
   }
   /**
    * Push the current HEAD to `branch` on the remote. When `token` is given and
@@ -1232,7 +1248,7 @@ var GitAdapter = class {
       if (authed !== url) target = authed;
     }
     try {
-      await execa2("git", ["push", target, `HEAD:refs/heads/${branch}`], { cwd });
+      await execa("git", ["push", target, `HEAD:refs/heads/${branch}`], { cwd });
     } catch (err) {
       throw gitFailure(`Failed to push branch '${branch}' to remote '${remote}'`, err, [opts.token]);
     }
@@ -1283,9 +1299,9 @@ var GitAdapter = class {
    */
   async setUpstreamAfterPush(cwd, branch, remote) {
     const opts = { cwd, reject: false };
-    await execa2("git", ["update-ref", `refs/remotes/${remote}/${branch}`, "HEAD"], opts);
-    await execa2("git", ["config", `branch.${branch}.remote`, remote], opts);
-    await execa2("git", ["config", `branch.${branch}.merge`, `refs/heads/${branch}`], opts);
+    await execa("git", ["update-ref", `refs/remotes/${remote}/${branch}`, "HEAD"], opts);
+    await execa("git", ["config", `branch.${branch}.remote`, remote], opts);
+    await execa("git", ["config", `branch.${branch}.merge`, `refs/heads/${branch}`], opts);
   }
 };
 function injectToken(repoUrl, token) {
@@ -4296,7 +4312,7 @@ var defaultRunCommand = async (command, cwd) => {
   const [bin, ...args] = command;
   if (!bin) return { ok: false, error: "empty command" };
   try {
-    await execa3(bin, args, {
+    await execa(bin, args, {
       cwd,
       // TWO REASONS THIS HUNG FOR 29 HOURS, AND THE FIX NEEDS BOTH.
       //
@@ -8707,7 +8723,6 @@ import chalk15 from "chalk";
 import { Command as Command15 } from "commander";
 
 // src/adapters/plugin-migrations/index.ts
-import { execa as execa4 } from "execa";
 import { join as join28 } from "path";
 var PluginMigrationsAdapter = class {
   /**
@@ -8732,7 +8747,7 @@ var PluginMigrationsAdapter = class {
     }
     let result;
     try {
-      result = await execa4("uv", args, { cwd: join28(cwd, "services", "api") });
+      result = await execa("uv", args, { cwd: join28(cwd, "services", "api") });
     } catch (err) {
       const cause = err;
       if (cause.code === "ENOENT") {
@@ -8751,7 +8766,6 @@ var PluginMigrationsAdapter = class {
 // src/lib/plugin-provenance.ts
 import { existsSync as existsSync28, readFileSync as readFileSync21, writeFileSync as writeFileSync10 } from "fs";
 import { join as join29 } from "path";
-import { execa as execa5 } from "execa";
 var PLUGIN_PROVENANCE_FILENAME = ".biffo-plugin-provenance.json";
 function isPluginProvenance(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -8813,7 +8827,7 @@ function resolveRegistryProvenance(repoUrl, sha) {
 }
 async function isGitWorkingTree(dir) {
   try {
-    await execa5("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
+    await execa("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
     return true;
   } catch {
     return false;
@@ -8821,7 +8835,7 @@ async function isGitWorkingTree(dir) {
 }
 async function tryGit(cwd, args) {
   try {
-    const { stdout } = await execa5("git", args, { cwd });
+    const { stdout } = await execa("git", args, { cwd });
     return stdout.trim() || null;
   } catch {
     return null;
@@ -8870,7 +8884,6 @@ function vendorPluginSeed(pluginSourceDir, manifest, cwd) {
 // src/lib/plugin-source-copy.ts
 import { copyFileSync as copyFileSync2, cpSync as cpSync4, mkdirSync as mkdirSync10 } from "fs";
 import { basename, dirname as dirname9, join as join31 } from "path";
-import { execa as execa6 } from "execa";
 var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".git",
   ".venv",
@@ -8904,14 +8917,14 @@ async function copyPluginSource(sourceDir, targetDir) {
 }
 async function isGitWorkingTree2(dir) {
   try {
-    await execa6("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
+    await execa("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
     return true;
   } catch {
     return false;
   }
 }
 async function listGitFiles(dir) {
-  const { stdout } = await execa6(
+  const { stdout } = await execa(
     "git",
     ["ls-files", "--cached", "--others", "--exclude-standard", "-z"],
     { cwd: dir }
@@ -9851,7 +9864,6 @@ import { cpSync as cpSync6, existsSync as existsSync36, mkdirSync as mkdirSync12
 import { join as join38, relative as relative7, resolve as resolve17 } from "path";
 import chalk19 from "chalk";
 import { Command as Command20 } from "commander";
-import { execa as execa7 } from "execa";
 import inquirer7 from "inquirer";
 var pluginUpgradeCommand = new Command20("upgrade").description(
   "Upgrade an installed plugin to a new minor version (biffo plugin upgrade <name>@<new-minor>) or refresh it in place from a local, unpublished checkout (biffo plugin upgrade --local <path>)"
@@ -10180,7 +10192,7 @@ var defaultRunCommand2 = async (command, cwd) => {
   const [bin, ...args] = command;
   if (!bin) return { ok: false, error: "empty command" };
   try {
-    await execa7(bin, args, {
+    await execa(bin, args, {
       cwd,
       // TWO REASONS THIS HUNG FOR 29 HOURS, AND THE FIX NEEDS BOTH.
       //
@@ -10590,7 +10602,6 @@ import { Command as Command24 } from "commander";
 // src/scripts/check-adr-numbering.ts
 import { existsSync as existsSync39 } from "fs";
 import { join as join40 } from "path";
-import { execa as execa8 } from "execa";
 
 // src/lib/adr-numbering-guard.ts
 import { existsSync as existsSync38, readdirSync as readdirSync15, readFileSync as readFileSync29 } from "fs";
@@ -10664,7 +10675,7 @@ function formatAdrReservedRangeViolations(violations, reservedUpTo = TEMPLATE_AD
 
 // src/scripts/check-adr-numbering.ts
 async function runAdrNumberingCheck() {
-  const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const adrDir = join40(root, "docs", "ADR");
   if (!existsSync39(adrDir)) {
     console.log("\u2713 ADR numbering guard: no docs/ADR/ directory \u2014 nothing to compare");
@@ -10705,7 +10716,6 @@ Already accepted? List it in docs/ADR/${ALLOWLIST_FILENAME} instead of leaving t
 
 // src/scripts/check-branch-protection.ts
 import { Octokit as Octokit2 } from "@octokit/rest";
-import { execa as execa9 } from "execa";
 
 // src/lib/branch-protection-apply.ts
 var CONTEXT_CONSISTENCY_THRESHOLD = 2 / 3;
@@ -10832,7 +10842,7 @@ async function resolveRepo(explicit) {
     }
     return { owner, repo };
   }
-  const { stdout } = await execa9("git", ["remote", "get-url", "origin"]);
+  const { stdout } = await execa("git", ["remote", "get-url", "origin"]);
   const m = /github\.com[:/]([^/]+)\/(.+?)(?:\.git)?$/.exec(stdout.trim());
   if (!m?.[1] || !m[2]) {
     console.error(
@@ -10963,9 +10973,6 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
   console.log(`\u2713 branch-protection guard: ${owner}/${repo} (${audited.join(", ")}) OK`);
 }
 
-// src/scripts/check-claim-invocation.ts
-import { execa as execa10 } from "execa";
-
 // src/lib/claim-invocation-parity.ts
 import { existsSync as existsSync40, readFileSync as readFileSync30, readdirSync as readdirSync16 } from "fs";
 import { join as join41 } from "path";
@@ -11090,7 +11097,7 @@ function formatParityViolations(violations) {
 
 // src/scripts/check-claim-invocation.ts
 async function runClaimInvocationCheck() {
-  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const docs = distributedAgentsDocs(root);
   console.log(
     `audited ${docs.length} distributed AGENTS.md (${docs.map((d) => d.path).join(", ") || "none"}) under ${root}`
@@ -11112,7 +11119,6 @@ async function runClaimInvocationCheck() {
 // src/scripts/check-codeql-suppression.ts
 import { existsSync as existsSync41 } from "fs";
 import { join as join43, relative as relative8 } from "path";
-import { execa as execa11 } from "execa";
 
 // src/lib/codeql-suppression-guard.ts
 import { readdirSync as readdirSync17, readFileSync as readFileSync31, statSync as statSync9 } from "fs";
@@ -11183,7 +11189,7 @@ function sweepCodeqlSuppressionComments(root) {
 
 // src/scripts/check-codeql-suppression.ts
 async function runCodeqlSuppressionCheck() {
-  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const scanRoot = join43(root, "cli", "src");
   if (!existsSync41(scanRoot)) {
     console.log(
@@ -11208,9 +11214,6 @@ async function runCodeqlSuppressionCheck() {
   console.log("\u2713 codeql-suppression guard: no dead `codeql[...]` suppression comment found");
 }
 
-// src/scripts/check-cognito-invite-template.ts
-import { execa as execa12 } from "execa";
-
 // src/lib/cognito-invite-template-guard.ts
 import { readdirSync as readdirSync18, readFileSync as readFileSync32, statSync as statSync10 } from "fs";
 import { join as join44 } from "path";
@@ -11316,7 +11319,7 @@ function checkCognitoInviteTemplates(repoRoot) {
 
 // src/scripts/check-cognito-invite-template.ts
 async function runCognitoInviteTemplateCheck() {
-  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findModuleTerraformFiles(root);
   console.log(`audited ${files.length} .tf file(s) under modules/ under ${root}`);
   if (files.length === 0) {
@@ -11339,7 +11342,6 @@ async function runCognitoInviteTemplateCheck() {
 
 // src/scripts/check-core-direct-paths.ts
 import { join as join46 } from "path";
-import { execa as execa13 } from "execa";
 
 // src/lib/core-direct-paths-audit.ts
 import { existsSync as existsSync42, readFileSync as readFileSync33, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
@@ -11667,7 +11669,7 @@ function auditSiblingCoreDirectPaths(params) {
 
 // src/scripts/check-core-direct-paths.ts
 async function runCoreDirectPathsCheck(opts = {}) {
-  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const sibling = opts.sibling ?? "sibling-template (self-check)";
   const frontendSrcDir = opts.frontendSrc ?? join46(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
   let coreApiSrcDir;
@@ -11721,7 +11723,6 @@ async function runCoreDirectPathsCheck(opts = {}) {
 }
 
 // src/scripts/check-core-ownership.ts
-import { execa as execa14 } from "execa";
 var BOLD = "\x1B[1m";
 var DIM = "\x1B[2m";
 var RED = "\x1B[31m";
@@ -11732,7 +11733,7 @@ async function runOwnershipCheck(argv) {
   const stagedFlag = args.indexOf("--staged");
   const staged = stagedFlag !== -1;
   const messageFile = staged ? args[stagedFlag + 1] : void 0;
-  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const ownership = classifyRepoOwnership(root);
   if (ownership === "template") {
     console.log("\u2713 core ownership guard: skipped \u2014 this is the template, which owns these paths.");
@@ -11748,7 +11749,7 @@ async function runOwnershipCheck(argv) {
   let deletedFiles = [];
   let commitMessage = "";
   if (staged) {
-    const { stdout } = await execa14("git", ["diff", "--cached", "--name-status"], { cwd: root });
+    const { stdout } = await execa("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
       const { readFileSync: readFileSync45, existsSync: existsSync54 } = await import("fs");
@@ -11760,18 +11761,18 @@ async function runOwnershipCheck(argv) {
       console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
       process.exit(2);
     }
-    await execa14("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-    const { stdout } = await execa14("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
+    await execa("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+    const { stdout } = await execa("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
       cwd: root
     });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
-    const { stdout: log2 } = await execa14("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
+    const { stdout: log2 } = await execa("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
       cwd: root,
       reject: false
     });
     commitMessage = log2;
   }
-  const { stdout: gitBranch } = await execa14("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+  const { stdout: gitBranch } = await execa("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
     cwd: root,
     reject: false
   });
@@ -11852,9 +11853,6 @@ ${BOLD}If the divergence is deliberate${OFF}
   process.exit(1);
 }
 
-// src/scripts/check-eventbridge-log-permissions.ts
-import { execa as execa15 } from "execa";
-
 // src/lib/eventbridge-log-permission-guard.ts
 import { readFileSync as readFileSync34, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
 import { join as join47 } from "path";
@@ -12030,7 +12028,7 @@ function auditEventBridgeLogPermissions(root) {
 
 // src/scripts/check-eventbridge-log-permissions.ts
 async function runEventBridgeLogPermissionCheck() {
-  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let report;
   try {
     report = auditEventBridgeLogPermissions(root);
@@ -12069,7 +12067,6 @@ async function runEventBridgeLogPermissionCheck() {
 // src/scripts/check-instance-adoption.ts
 import { existsSync as existsSync43 } from "fs";
 import { join as join48 } from "path";
-import { execa as execa16 } from "execa";
 async function runInstanceAdoptionCheck(opts = {}) {
   if (!opts.instanceDir) {
     console.error(
@@ -12083,7 +12080,7 @@ async function runInstanceAdoptionCheck(opts = {}) {
     );
     process.exit(2);
   }
-  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const theirsDir = opts.theirsDir ?? root;
   const instanceLabel = opts.instance ?? join48(opts.instanceDir).split("/").filter(Boolean).pop();
   const report = checkInstanceAdoption(theirsDir, opts.instanceDir);
@@ -12106,9 +12103,6 @@ async function runInstanceAdoptionCheck(opts = {}) {
   process.exit(1);
 }
 
-// src/scripts/check-lambda-output.ts
-import { execa as execa17 } from "execa";
-
 // src/lib/lambda-output-guard.ts
 import { readFileSync as readFileSync36 } from "fs";
 import { join as join50 } from "path";
@@ -12269,7 +12263,7 @@ function checkLambdaOutput(repoRoot) {
 
 // src/scripts/check-lambda-output.ts
 async function runLambdaOutputCheck() {
-  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -12291,7 +12285,6 @@ async function runLambdaOutputCheck() {
 }
 
 // src/scripts/check-migration-body-change.ts
-import { execa as execa18 } from "execa";
 import { existsSync as existsSync45 } from "fs";
 import { join as join51 } from "path";
 
@@ -12348,11 +12341,11 @@ var GREEN = "\x1B[32m";
 var YELLOW2 = "\x1B[33m";
 var OFF2 = "\x1B[0m";
 async function showAt(ref, path, cwd) {
-  const result = await execa18("git", ["show", `${ref}:${path}`], { cwd, reject: false });
+  const result = await execa("git", ["show", `${ref}:${path}`], { cwd, reject: false });
   return result.exitCode === 0 ? result.stdout : null;
 }
 async function runMigrationBodyChangeCheck(argv) {
-  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   if (isInstanceRepo(root)) {
     console.log(
       `\u2713 migration body-change guard: skipped \u2014 this is an instance (${INSTANCE_CORE_FILE} present). Its migrations/versions/ is a carried, user-owned copy, not the template source this guard protects.`
@@ -12368,8 +12361,8 @@ async function runMigrationBodyChangeCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  await execa18("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa18(
+  await execa("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa(
     "git",
     [
       "diff",
@@ -12463,7 +12456,6 @@ ${BOLD2}What to do${OFF2}
 // src/scripts/check-pipe-trap.ts
 import { readFileSync as readFileSync37, readdirSync as readdirSync22 } from "fs";
 import { join as join52, relative as relative9 } from "path";
-import { execa as execa19 } from "execa";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -12575,7 +12567,7 @@ function shellFiles(root) {
   return out;
 }
 async function runPipeTrapCheck() {
-  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = shellFiles(root);
   console.log(`audited ${files.length} shell file(s) under scripts/ and .githooks/ under ${root}`);
   if (files.length === 0) {
@@ -12601,9 +12593,6 @@ async function runPipeTrapCheck() {
   console.log(`\u2713 Pipe-trap guard: no status-bearing command is piped away`);
 }
 
-// src/scripts/check-plugin-allowlist-convention.ts
-import { execa as execa20 } from "execa";
-
 // src/lib/plugin-allowlist-convention.ts
 import { readFileSync as readFileSync38 } from "fs";
 import { join as join53 } from "path";
@@ -12713,7 +12702,7 @@ Plugins would be rejected by require_service_principal (ADR-0009). Fix the glob,
 
 // src/scripts/check-plugin-allowlist-convention.ts
 async function runPluginAllowlistConventionCheck() {
-  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let violations;
   try {
     violations = checkAllowlistConvention(root);
@@ -12740,7 +12729,6 @@ async function runPluginAllowlistConventionCheck() {
 // src/scripts/check-plugin-collisions.ts
 import { existsSync as existsSync47 } from "fs";
 import { join as join55 } from "path";
-import { execa as execa21 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
 import { existsSync as existsSync46, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
@@ -12810,7 +12798,7 @@ function formatCollisions(collisions) {
 
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
-  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const servicesDir = join55(root, "services");
   if (!existsSync47(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
@@ -12828,9 +12816,6 @@ async function runPluginCollisionCheck() {
   console.log("\u2713 plugin collision guard: OK");
 }
 
-// src/scripts/check-plugin-terraform.ts
-import { execa as execa22 } from "execa";
-
 // src/lib/plugin-terraform-guard.ts
 import { existsSync as existsSync48, readFileSync as readFileSync39, readdirSync as readdirSync24 } from "fs";
 import { dirname as dirname10, join as join56, relative as relative10, sep as sep4 } from "path";
@@ -12902,7 +12887,7 @@ function formatViolations(violations) {
 
 // src/scripts/check-plugin-terraform.ts
 async function runPluginTerraformCheck() {
-  const root = (await execa22("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const violations = checkPluginTerraform(root);
   if (violations.length > 0) {
     console.error("\u2717 plugin Terraform guard: event subscriptions with no infrastructure\n");
@@ -12915,7 +12900,6 @@ async function runPluginTerraformCheck() {
 // src/scripts/check-plugin-tool-supply.ts
 import { existsSync as existsSync50 } from "fs";
 import { join as join58 } from "path";
-import { execa as execa23 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
 import { existsSync as existsSync49, readFileSync as readFileSync40, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
@@ -13867,7 +13851,7 @@ function auditPluginToolSupply(pluginsRoot) {
 
 // src/scripts/check-plugin-tool-supply.ts
 async function runPluginToolSupplyCheck() {
-  const root = (await execa23("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
   const pluginsRoot = join58(root, "services", "_plugins");
   if (!existsSync50(pluginsRoot)) {
@@ -13946,9 +13930,6 @@ async function runPluginToolSupplyCheck() {
   }
 }
 
-// src/scripts/check-release-subject.ts
-import { execa as execa24 } from "execa";
-
 // src/lib/release-version.ts
 var MINOR_TYPES = /* @__PURE__ */ new Set(["feat"]);
 var SUBJECT = /^([a-z]+)(?:\([^)]*\))?(!)?:\s+\S/;
@@ -13984,7 +13965,7 @@ async function fetchPrTitleViaGh({
   PR_NUMBER,
   GH_REPO
 }) {
-  const { stdout } = await execa24(
+  const { stdout } = await execa(
     "gh",
     ["pr", "view", PR_NUMBER, "--repo", GH_REPO, "--json", "title", "--jq", ".title"],
     { env: { ...process.env, GH_TOKEN } }
@@ -14020,7 +14001,7 @@ async function resolveReleaseSubject({
       );
     }
   }
-  return (await execa24("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
+  return (await execa("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
 }
 async function runReleaseSubjectCheck(argv) {
   const base = process.env["GITHUB_BASE_REF"] ?? argv[0];
@@ -14028,9 +14009,9 @@ async function runReleaseSubjectCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  const root = (await execa24("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  await execa24("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa24("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  await execa("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
     cwd: root
   });
   const changedFiles = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -14283,7 +14264,6 @@ async function runSharedFileReductionCheck(args) {
 // src/scripts/check-skeleton-drift.ts
 import { existsSync as existsSync51, readdirSync as readdirSync27 } from "fs";
 import { join as join60 } from "path";
-import { execa as execa25 } from "execa";
 
 // src/lib/skeleton-drift-guard.ts
 import { readFileSync as readFileSync43, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
@@ -14412,7 +14392,7 @@ function discoverSkeletons(root) {
   return entries.filter((name) => existsSync51(join60(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
-  const root = (await execa25("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
@@ -14444,9 +14424,8 @@ async function runSkeletonDriftCheck() {
 }
 
 // src/scripts/check-terraform-input.ts
-import { execa as execa26 } from "execa";
 async function runTerraformInputCheck() {
-  const root = (await execa26("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.296.17",
+  "version": "0.297.1",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",