@biffo/cli 0.296.9 → 0.296.11

package/_skeletons/plugin-template/scripts/error_branch_coverage.py

@@ -418,16 +418,47 @@ def main() -> int:
             file=sys.stderr,
         )
 
+    reports = [json.loads(p.read_text()) for p in present]
+    coverage = merge_coverage(reports)
+    file_count = len(coverage.get("files", {}))
+
     # Restated in every summary line below (not just the warning above) so the
     # denominator survives even if the warning scrolls past unread: a reader
     # who sees only the final line still learns how much of the requested
-    # picture this result is actually over.
-    coverage_note = f"{len(present)}/{len(coverage_paths)} coverage artefact(s)"
+    # picture this result is actually over. The file count is part of that
+    # denominator, not just the artefact count — see the fail-closed check
+    # immediately below for why (#1657).
+    coverage_note = (
+        f"{len(present)}/{len(coverage_paths)} coverage artefact(s), {file_count} file(s)"
+    )
     if absent:
         coverage_note += f" — MISSING: {', '.join(str(p) for p in absent)}"
 
-    reports = [json.loads(p.read_text()) for p in present]
-    coverage = merge_coverage(reports)
+    if file_count == 0:
+        # #1657: an artefact can be present and valid JSON while still
+        # describing NOTHING — `{"files": {}}`, or `files` absent entirely.
+        # That reads identically to "everything is covered" to the logic
+        # below (found == [], keys == [], nothing NEW), so --check would
+        # exit 0 over a report that examined zero files: a fail-open in the
+        # gate that exists specifically to catch fail-opens. Every other
+        # soft-open path here (no baseline, a missing --coverage file)
+        # announces itself loudly and still proceeds; this one cannot
+        # proceed at all, because there is no denominator left to reason
+        # over. Fail closed rather than fail open: refuse both --write
+        # (never baseline a measurement of nothing) and --check (never let
+        # a growth check pass over nothing to check).
+        print(
+            f"::error::error-branch coverage: {coverage_note} — the merged "
+            "coverage report describes 0 files. Refusing to treat that as "
+            "clean: a report with nothing in it is not evidence the tree is "
+            "covered, it is evidence nothing was measured (a "
+            "[tool.coverage.run] source pointed at the wrong tree, a "
+            "truncated or hand-staged artefact, a coverage run against an "
+            "empty package). Fix the coverage run and try again.",
+            file=sys.stderr,
+        )
+        return 2
+
     found = unexecuted(coverage, source_root)
     keys = sorted({b.key() for b in found})
 
@@ -436,7 +467,7 @@ def main() -> int:
         baseline_path.write_text(
             json.dumps({"total": len(keys), "branches": keys}, indent=2) + "\n",
         )
-        print(f"baseline written: {len(keys)} unexecuted error branches")
+        print(f"baseline written: {len(keys)} unexecuted error branches ({coverage_note})")
         return 0
 
     baseline = load_baseline(baseline_path)

package/_skeletons/sibling-template/scripts/error_branch_coverage.py

@@ -418,16 +418,47 @@ def main() -> int:
             file=sys.stderr,
         )
 
+    reports = [json.loads(p.read_text()) for p in present]
+    coverage = merge_coverage(reports)
+    file_count = len(coverage.get("files", {}))
+
     # Restated in every summary line below (not just the warning above) so the
     # denominator survives even if the warning scrolls past unread: a reader
     # who sees only the final line still learns how much of the requested
-    # picture this result is actually over.
-    coverage_note = f"{len(present)}/{len(coverage_paths)} coverage artefact(s)"
+    # picture this result is actually over. The file count is part of that
+    # denominator, not just the artefact count — see the fail-closed check
+    # immediately below for why (#1657).
+    coverage_note = (
+        f"{len(present)}/{len(coverage_paths)} coverage artefact(s), {file_count} file(s)"
+    )
     if absent:
         coverage_note += f" — MISSING: {', '.join(str(p) for p in absent)}"
 
-    reports = [json.loads(p.read_text()) for p in present]
-    coverage = merge_coverage(reports)
+    if file_count == 0:
+        # #1657: an artefact can be present and valid JSON while still
+        # describing NOTHING — `{"files": {}}`, or `files` absent entirely.
+        # That reads identically to "everything is covered" to the logic
+        # below (found == [], keys == [], nothing NEW), so --check would
+        # exit 0 over a report that examined zero files: a fail-open in the
+        # gate that exists specifically to catch fail-opens. Every other
+        # soft-open path here (no baseline, a missing --coverage file)
+        # announces itself loudly and still proceeds; this one cannot
+        # proceed at all, because there is no denominator left to reason
+        # over. Fail closed rather than fail open: refuse both --write
+        # (never baseline a measurement of nothing) and --check (never let
+        # a growth check pass over nothing to check).
+        print(
+            f"::error::error-branch coverage: {coverage_note} — the merged "
+            "coverage report describes 0 files. Refusing to treat that as "
+            "clean: a report with nothing in it is not evidence the tree is "
+            "covered, it is evidence nothing was measured (a "
+            "[tool.coverage.run] source pointed at the wrong tree, a "
+            "truncated or hand-staged artefact, a coverage run against an "
+            "empty package). Fix the coverage run and try again.",
+            file=sys.stderr,
+        )
+        return 2
+
     found = unexecuted(coverage, source_root)
     keys = sorted({b.key() for b in found})
 
@@ -436,7 +467,7 @@ def main() -> int:
         baseline_path.write_text(
             json.dumps({"total": len(keys), "branches": keys}, indent=2) + "\n",
         )
-        print(f"baseline written: {len(keys)} unexecuted error branches")
+        print(f"baseline written: {len(keys)} unexecuted error branches ({coverage_note})")
         return 0
 
     baseline = load_baseline(baseline_path)

package/_skeletons/sibling-template/services/api/uv.lock

@@ -574,11 +574,11 @@ wheels = [
 
 [[package]]
 name = "pip"
-version = "26.1.2"
+version = "26.2.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/01/91/47e7d486260f618783899587af63ccf7980fb60245c3e63dd4571c6b57ad/pip-26.1.2.tar.gz", hash = "sha256:f49cd134c61cf2fd75e0ce2676db03e4054504a5a4986d00f8299ae632dc4605", size = 1840799, upload-time = "2026-05-31T17:33:58.56Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ae/15/4500e320e6b101ec3b719ae85b697d9940b6cda672bc555bd6016fc60c6f/pip-26.2.1.tar.gz", hash = "sha256:f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f", size = 1848877, upload-time = "2026-08-04T22:51:14.148Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5d/95/6b5cb3461ea5673ba0995989746db58eb18b91b54dbf331e72f569540946/pip-26.1.2-py3-none-any.whl", hash = "sha256:382ff9f685ee3bc25864f820aa50505825f10f5458ffff07e30a6d96e5715cab", size = 1813144, upload-time = "2026-05-31T17:33:56.772Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/6e/1736e5b4ae2b778ef2f81c47d797de9f891d4d8acb047a24ca37a60294dd/pip-26.2.1-py3-none-any.whl", hash = "sha256:71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e", size = 1816632, upload-time = "2026-08-04T22:51:12.472Z" },
 ]
 
 [[package]]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.296.9",
+  "version": "0.296.11",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",