@biffo/cli 0.301.7 → 0.301.8

package/_skeletons/plugin-template/scripts/check-closing-keywords.mjs

@@ -252,6 +252,41 @@ export const DEPLOY_ONLY_PREFIXES = [
 /** An issue reference GitHub linkifies: `#12` or `owner/repo#12`. */
 const REFERENCE = '(?:[\\w.-]+/[\\w.-]+)?#\\d+'
 
+/**
+ * The whitespace allowed between a closing keyword (plus its optional `:`)
+ * and the issue reference it governs, in `closingReferences`,
+ * `deliberateClosingReferences` and `negatedClosingReferences` alike — all
+ * three end their pattern with the identical `\b:?\s+(REFERENCE)` tail, and
+ * all three had the identical bug.
+ *
+ * A bare `\s+` matches across an ARBITRARY run of blank lines, so a
+ * markdown heading ending in a closing keyword matched against a `#N` that
+ * starts a completely unrelated paragraph two lines later — nothing in the
+ * character class stopped it from spanning the blank line between them.
+ * Real instance, PR #1789's own body:
+ *
+ *   ## What this fixes
+ *
+ *   #1717 fixed one of two acceptance routes ...
+ *
+ * "fixes" is the last word of the heading; "#1717" is the first token of
+ * the next paragraph's own, unrelated sentence. `closingReferences`
+ * nonetheless reported `#1717` as a hit — `\s+` matched the `"\n\n"`
+ * between them — and that false hit reached the `deploy-only-path` branch
+ * of `assess`, which (unlike the two ground-truth branches) has no
+ * reconciliation step and fails on whatever `closingReferences` reports
+ * verbatim. Confirmed against GitHub's own ground truth for that PR
+ * (`gh pr view 1789 --json closingIssuesReferences`): only `#1718` — the
+ * genuine `Closes #1718` trailer — is ever returned; #1717 never was.
+ *
+ * A single line break is still allowed: nothing in this repo's corpus
+ * needs it, but there is no evidence GitHub REQUIRES same-line adjacency
+ * either, and the conservative/fail-closed choice for a guard whose job is
+ * "don't miss a real close" is to keep allowing one newline and exclude
+ * only a genuine blank line (two or more).
+ */
+const KEYWORD_REFERENCE_GAP = '(?:[ \\t]+|[ \\t]*\\n[ \\t]*)'
+
 /**
  * Blank out fenced code blocks and inline code spans, preserving line count.
  *
@@ -290,7 +325,10 @@ export function stripCode(body) {
 export function closingReferences(body, { code = true } = {}) {
   if (!body) return []
   const withoutCode = code ? stripCode(body) : body
-  const pattern = new RegExp(`\\b(${CLOSING_KEYWORDS.join('|')})\\b:?\\s+(${REFERENCE})`, 'gi')
+  const pattern = new RegExp(
+    `\\b(${CLOSING_KEYWORDS.join('|')})\\b:?${KEYWORD_REFERENCE_GAP}(${REFERENCE})`,
+    'gi',
+  )
   return [...withoutCode.matchAll(pattern)].map((m) => m[2])
 }
 
@@ -361,7 +399,7 @@ export function deliberateClosingReferences(text, { code = true } = {}) {
   while ((m = boundary.exec(stripped))) starts.add(m.index + m[0].length)
 
   const pattern = new RegExp(
-    `^${CLAUSE_DECORATION}\\s*(${CLOSING_KEYWORDS.join('|')})\\b:?\\s+(${REFERENCE})`,
+    `^${CLAUSE_DECORATION}\\s*(${CLOSING_KEYWORDS.join('|')})\\b:?${KEYWORD_REFERENCE_GAP}(${REFERENCE})`,
     'i',
   )
   const found = []
@@ -435,7 +473,7 @@ export function negatedClosingReferences(body, { code = true } = {}) {
   const text = code ? stripCode(body) : body
   const authored = body.split('\n')
   const pattern = new RegExp(
-    `(?:${NEGATIONS.join('|')})\\s+(?:${CLOSING_KEYWORDS.join('|')})\\b:?\\s+(${REFERENCE})`,
+    `(?:${NEGATIONS.join('|')})\\s+(?:${CLOSING_KEYWORDS.join('|')})\\b:?${KEYWORD_REFERENCE_GAP}(${REFERENCE})`,
     'gi',
   )
   return [...text.matchAll(pattern)].map((m) => {

package/_skeletons/sibling-template/scripts/check-closing-keywords.mjs

@@ -252,6 +252,41 @@ export const DEPLOY_ONLY_PREFIXES = [
 /** An issue reference GitHub linkifies: `#12` or `owner/repo#12`. */
 const REFERENCE = '(?:[\\w.-]+/[\\w.-]+)?#\\d+'
 
+/**
+ * The whitespace allowed between a closing keyword (plus its optional `:`)
+ * and the issue reference it governs, in `closingReferences`,
+ * `deliberateClosingReferences` and `negatedClosingReferences` alike — all
+ * three end their pattern with the identical `\b:?\s+(REFERENCE)` tail, and
+ * all three had the identical bug.
+ *
+ * A bare `\s+` matches across an ARBITRARY run of blank lines, so a
+ * markdown heading ending in a closing keyword matched against a `#N` that
+ * starts a completely unrelated paragraph two lines later — nothing in the
+ * character class stopped it from spanning the blank line between them.
+ * Real instance, PR #1789's own body:
+ *
+ *   ## What this fixes
+ *
+ *   #1717 fixed one of two acceptance routes ...
+ *
+ * "fixes" is the last word of the heading; "#1717" is the first token of
+ * the next paragraph's own, unrelated sentence. `closingReferences`
+ * nonetheless reported `#1717` as a hit — `\s+` matched the `"\n\n"`
+ * between them — and that false hit reached the `deploy-only-path` branch
+ * of `assess`, which (unlike the two ground-truth branches) has no
+ * reconciliation step and fails on whatever `closingReferences` reports
+ * verbatim. Confirmed against GitHub's own ground truth for that PR
+ * (`gh pr view 1789 --json closingIssuesReferences`): only `#1718` — the
+ * genuine `Closes #1718` trailer — is ever returned; #1717 never was.
+ *
+ * A single line break is still allowed: nothing in this repo's corpus
+ * needs it, but there is no evidence GitHub REQUIRES same-line adjacency
+ * either, and the conservative/fail-closed choice for a guard whose job is
+ * "don't miss a real close" is to keep allowing one newline and exclude
+ * only a genuine blank line (two or more).
+ */
+const KEYWORD_REFERENCE_GAP = '(?:[ \\t]+|[ \\t]*\\n[ \\t]*)'
+
 /**
  * Blank out fenced code blocks and inline code spans, preserving line count.
  *
@@ -290,7 +325,10 @@ export function stripCode(body) {
 export function closingReferences(body, { code = true } = {}) {
   if (!body) return []
   const withoutCode = code ? stripCode(body) : body
-  const pattern = new RegExp(`\\b(${CLOSING_KEYWORDS.join('|')})\\b:?\\s+(${REFERENCE})`, 'gi')
+  const pattern = new RegExp(
+    `\\b(${CLOSING_KEYWORDS.join('|')})\\b:?${KEYWORD_REFERENCE_GAP}(${REFERENCE})`,
+    'gi',
+  )
   return [...withoutCode.matchAll(pattern)].map((m) => m[2])
 }
 
@@ -361,7 +399,7 @@ export function deliberateClosingReferences(text, { code = true } = {}) {
   while ((m = boundary.exec(stripped))) starts.add(m.index + m[0].length)
 
   const pattern = new RegExp(
-    `^${CLAUSE_DECORATION}\\s*(${CLOSING_KEYWORDS.join('|')})\\b:?\\s+(${REFERENCE})`,
+    `^${CLAUSE_DECORATION}\\s*(${CLOSING_KEYWORDS.join('|')})\\b:?${KEYWORD_REFERENCE_GAP}(${REFERENCE})`,
     'i',
   )
   const found = []
@@ -435,7 +473,7 @@ export function negatedClosingReferences(body, { code = true } = {}) {
   const text = code ? stripCode(body) : body
   const authored = body.split('\n')
   const pattern = new RegExp(
-    `(?:${NEGATIONS.join('|')})\\s+(?:${CLOSING_KEYWORDS.join('|')})\\b:?\\s+(${REFERENCE})`,
+    `(?:${NEGATIONS.join('|')})\\s+(?:${CLOSING_KEYWORDS.join('|')})\\b:?${KEYWORD_REFERENCE_GAP}(${REFERENCE})`,
     'gi',
   )
   return [...text.matchAll(pattern)].map((m) => {

package/dist/index.js

@@ -646,7 +646,7 @@ import {
   writeFileSync as writeFileSync2
 } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname3, join as join5 } from "path";
+import { basename, dirname as dirname3, join as join5 } from "path";
 import { z as z4 } from "zod";
 
 // src/lib/core-ownership-guard.ts
@@ -806,6 +806,76 @@ var EMPTY_SUMMARY = () => ({
   removed: 0,
   "remove-conflict": 0
 });
+function pathHasDivergenceTrailerInHistory(oursDir, path, manifest, git = defaultGit) {
+  let out;
+  try {
+    out = git(["-C", oursDir, "log", "--follow", "--format=%x02%H%x01%B", "--", path]);
+  } catch {
+    return false;
+  }
+  const entries = out.split("").map((entry) => entry.split("
")).filter((parts) => parts.length === 2 && parts[0] !== "");
+  const withTrailer = entries.filter(([, message]) => parseDivergenceTrailer(message) !== null);
+  if (withTrailer.length === 0) return false;
+  const graftedBoundary = shallowGraftCommits(oursDir, git);
+  for (const [hash, message] of withTrailer) {
+    if (graftedBoundary.has(hash)) continue;
+    let touched;
+    try {
+      touched = git([
+        "-C",
+        oursDir,
+        "diff-tree",
+        "--no-commit-id",
+        "--name-only",
+        "-r",
+        "--root",
+        hash
+      ]).split("\n").filter((p) => p !== "");
+    } catch {
+      touched = [];
+    }
+    const templateOwnedTouched = touched.filter((p) => isTemplateOwned(p, manifest));
+    if (templateOwnedTouched.length === 1 && templateOwnedTouched[0] === path) return true;
+    const reason = parseDivergenceTrailer(message);
+    if (reason !== null && trailerNamesPath(reason, path, templateOwnedTouched)) return true;
+  }
+  return false;
+}
+function shallowGraftCommits(oursDir, git) {
+  let isShallow;
+  try {
+    isShallow = git(["-C", oursDir, "rev-parse", "--is-shallow-repository"]).trim();
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+  if (isShallow !== "true") return /* @__PURE__ */ new Set();
+  try {
+    const out = git(["-C", oursDir, "rev-list", "--max-parents=0", "HEAD"]);
+    return new Set(
+      out.split("\n").map((s) => s.trim()).filter((s) => s !== "")
+    );
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+function trailerNamesPath(reason, path, templateOwnedTouched) {
+  const isBoundary = (ch) => ch === void 0 || !/[A-Za-z0-9_.-]/.test(ch);
+  const namedAt = (needle) => {
+    if (needle === "") return false;
+    let idx = 0;
+    for (; ; ) {
+      idx = reason.indexOf(needle, idx);
+      if (idx === -1) return false;
+      if (isBoundary(reason[idx - 1]) && isBoundary(reason[idx + needle.length])) return true;
+      idx += 1;
+    }
+  };
+  if (namedAt(path)) return true;
+  const base = basename(path);
+  if (!namedAt(base)) return false;
+  const sharingBasename = templateOwnedTouched.filter((p) => basename(p) === base);
+  return sharingBasename.length <= 1;
+}
 async function planCoreUpgrade(options) {
   const mergeFile = options.mergeFile ?? gitMergeFile;
   const trackedOnly = { trackedOnly: true };
@@ -819,7 +889,21 @@ async function planCoreUpgrade(options) {
   const ours = new Set(listTemplateOwnedFiles(options.oursDir, options.manifest));
   const theirs = new Set(listTemplateOwnedFiles(options.theirsDir, options.manifest, trackedOnly));
   const divergentPrefixes = readDivergenceConfig(options.oursDir).warnOnly.map((e) => e.prefix);
-  const isDeclaredDivergent = (path) => divergentPrefixes.some((prefix) => path.startsWith(prefix));
+  const trailerDivergenceCache = /* @__PURE__ */ new Map();
+  const isDeclaredDivergent = (path) => {
+    if (divergentPrefixes.some((prefix) => path.startsWith(prefix))) return true;
+    let viaTrailer = trailerDivergenceCache.get(path);
+    if (viaTrailer === void 0) {
+      viaTrailer = pathHasDivergenceTrailerInHistory(
+        options.oursDir,
+        path,
+        options.manifest,
+        options.git
+      );
+      trailerDivergenceCache.set(path, viaTrailer);
+    }
+    return viaTrailer;
+  };
   const paths = [.../* @__PURE__ */ new Set([...base, ...ours, ...theirs])].sort();
   const entries = [];
   const divergenceSkips = [];
@@ -3795,7 +3879,7 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
   }
   printNewInstanceSeams(newSeams);
   printAdoptionReport(adoption);
-  printOrphanReport(plan.orphaned, orphanRatchet);
+  printOrphanReport(plan.orphaned, orphanRatchet, plan.entries.length);
   if (orphanRatchet.increased) {
     throw new Error(
       `${String(plan.orphaned.length)} unsanctioned instance file(s) under a template-owned path (baseline ${String(orphanRatchet.baseline)}) \u2014 see the list above (#1026). Move new instance-written files under a sanctioned carve-out (services/api/tests/instance/, modules/**/instance/) or otherwise reduce the count, then re-run.`
@@ -4370,11 +4454,11 @@ function printTargetFidelity(report, toVersion) {
   for (const f of report.findings) console.log(`    ${chalk4.red(f.path)} \u2014 ${f.reason}`);
   console.log();
 }
-function printOrphanReport(orphaned, ratchet) {
+function printOrphanReport(orphaned, ratchet, examined) {
   if (orphaned.length === 0 && ratchet.baseline === null) return;
   console.log(
     chalk4.bold(
-      `  ${String(orphaned.length)} unsanctioned instance file(s) under a template-owned path (#1026):`
+      `  ${String(orphaned.length)} unsanctioned instance file(s) under a template-owned path (#1026), of ${String(examined)} template-owned path(s) examined:`
     )
   );
   for (const e of orphaned) console.log(`    ${chalk4.yellow(e.path)}`);
@@ -9000,7 +9084,7 @@ function vendorPluginSeed(pluginSourceDir, manifest, cwd) {
 
 // src/lib/plugin-source-copy.ts
 import { copyFileSync as copyFileSync2, cpSync as cpSync4, mkdirSync as mkdirSync10 } from "fs";
-import { basename, dirname as dirname9, join as join31 } from "path";
+import { basename as basename2, dirname as dirname9, join as join31 } from "path";
 var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".git",
   ".venv",
@@ -9028,7 +9112,7 @@ async function copyPluginSource(sourceDir, targetDir) {
   mkdirSync10(targetDir, { recursive: true });
   cpSync4(sourceDir, targetDir, {
     recursive: true,
-    filter: (src) => !LOCAL_COPY_EXCLUDES.has(basename(src))
+    filter: (src) => !LOCAL_COPY_EXCLUDES.has(basename2(src))
   });
   return { usedGitIgnoreRules: false };
 }
@@ -12591,7 +12675,7 @@ ${BOLD2}What to do${OFF2}
 
 // src/scripts/check-orphan-ratchet.ts
 import { existsSync as existsSync46 } from "fs";
-import { basename as basename2 } from "path";
+import { basename as basename3 } from "path";
 function reportOrphan(entry, manifest) {
   console.error(`  ${entry.path}`);
   const { templateOwnedMatch, nearestUserOwnedEntries } = explainOwnership(entry.path, manifest);
@@ -12624,7 +12708,7 @@ async function runOrphanRatchetCheck(opts = {}) {
   const theirsDir = opts.theirsDir ?? root;
   const instanceDir = opts.instanceDir ?? theirsDir;
   const baseDir = opts.baseDir ?? theirsDir;
-  const label = opts.label ?? (basename2(instanceDir) || instanceDir);
+  const label = opts.label ?? (basename3(instanceDir) || instanceDir);
   if (instanceDir === theirsDir && baseDir === theirsDir) {
     console.log(
       "self-check mode: --instance-dir was not given, so it defaulted to --theirs-dir (this repo's own root) alongside --base-dir \u2014 all three trees are the same, so this run can only ever find zero orphans by construction. See this script's doc comment. Pass a real instance tree with --instance-dir for a check that can actually find something. biffo-template#1714."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.301.7",
+  "version": "0.301.8",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",