@biffo/cli 0.301.9 → 0.301.11

package/_skeletons/sibling-template/apps/frontend/package.json

@@ -47,7 +47,8 @@
       "brace-expansion@<5.0.9": ">=5.0.9",
       "undici@<7.29.0": ">=7.29.0",
       "js-yaml@<4.3.1": ">=4.3.1 <5",
-      "nanoid@<3.3.17": ">=3.3.17 <4"
+      "nanoid@<3.3.17": ">=3.3.17 <4",
+      "browserslist@<4.28.7": ">=4.28.7"
     }
   }
 }

package/_skeletons/sibling-template/apps/frontend/pnpm-lock.yaml

@@ -11,6 +11,7 @@ overrides:
   undici@<7.29.0: '>=7.29.0'
   js-yaml@<4.3.1: '>=4.3.1 <5'
   nanoid@<3.3.17: '>=3.3.17 <4'
+  browserslist@<4.28.7: '>=4.28.7'
 
 importers:
 
@@ -1230,8 +1231,8 @@ packages:
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
-  baseline-browser-mapping@2.10.41:
-    resolution: {integrity: sha512-WwS7MHhqGHHlaVsqRZnhvCEMS0owDX+SxRlve7JkuH7My1Ara3ZriTmCQupPfYjxMZ8I/tgxtJYr2t7taHaH4A==}
+  baseline-browser-mapping@2.11.20:
+    resolution: {integrity: sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==}
     engines: {node: '>=6.0.0'}
     hasBin: true
 
@@ -1246,8 +1247,8 @@ packages:
     resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
     engines: {node: '>=8'}
 
-  browserslist@4.28.4:
-    resolution: {integrity: sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw==}
+  browserslist@4.28.8:
+    resolution: {integrity: sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==}
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
     hasBin: true
 
@@ -1273,6 +1274,9 @@ packages:
   caniuse-lite@1.0.30001800:
     resolution: {integrity: sha512-MMHtuAz9Ys840zAY5F4k6fV5GaivZ9sPk+nz0mY+GYVzRBnYkN0mpqkSR92oWRQ19yQWo4HvBV/FnC16AJX8MA==}
 
+  caniuse-lite@1.0.30001810:
+    resolution: {integrity: sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==}
+
   chai@6.2.2:
     resolution: {integrity: sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==}
     engines: {node: '>=18'}
@@ -1380,8 +1384,8 @@ packages:
     resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
     engines: {node: '>= 0.4'}
 
-  electron-to-chromium@1.5.385:
-    resolution: {integrity: sha512-78sa/M08MNAYHQfjoWMvOlKQqZ0ElhSm/L5HNUc96VZ3b+KvDVnngFm8sYQy0XrhTRgAhggHr5abA7yTvRdo4Q==}
+  electron-to-chromium@1.5.420:
+    resolution: {integrity: sha512-2yD6XreGusOfNV+dUcvipJEXc3n/n7fgr7996aszTG+YY5E4mqM4tOq/3uhP129cazL9YHbVWSpc79ePotWtPA==}
 
   emoji-regex@9.2.2:
     resolution: {integrity: sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==}
@@ -2031,8 +2035,8 @@ packages:
       encoding:
         optional: true
 
-  node-releases@2.0.50:
-    resolution: {integrity: sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==}
+  node-releases@2.0.54:
+    resolution: {integrity: sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==}
     engines: {node: '>=18'}
 
   object-assign@4.1.1:
@@ -2465,11 +2469,11 @@ packages:
   unrs-resolver@1.12.2:
     resolution: {integrity: sha512-dmlRxBJJayXjqTwC+JtF1HhJmgf3ftQ3YejFcZrf4+KKtJv0qDsK1pjqaaVjG7wJ5NJ6UVP1OqRMQ71Z4C3rxQ==}
 
-  update-browserslist-db@1.2.3:
-    resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
+  update-browserslist-db@1.3.2:
+    resolution: {integrity: sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==}
     hasBin: true
     peerDependencies:
-      browserslist: '>= 4.21.0'
+      browserslist: '>=4.28.7'
 
   uri-js@4.4.1:
     resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
@@ -2705,7 +2709,7 @@ snapshots:
     dependencies:
       '@babel/compat-data': 7.29.7
       '@babel/helper-validator-option': 7.29.7
-      browserslist: 4.28.4
+      browserslist: 4.28.8
       lru-cache: 5.1.1
       semver: 6.3.1
 
@@ -3665,7 +3669,7 @@ snapshots:
 
   base64-js@1.5.1: {}
 
-  baseline-browser-mapping@2.10.41: {}
+  baseline-browser-mapping@2.11.20: {}
 
   bidi-js@1.0.3:
     dependencies:
@@ -3679,13 +3683,13 @@ snapshots:
     dependencies:
       fill-range: 7.1.1
 
-  browserslist@4.28.4:
+  browserslist@4.28.8:
     dependencies:
-      baseline-browser-mapping: 2.10.41
-      caniuse-lite: 1.0.30001800
-      electron-to-chromium: 1.5.385
-      node-releases: 2.0.50
-      update-browserslist-db: 1.2.3(browserslist@4.28.4)
+      baseline-browser-mapping: 2.11.20
+      caniuse-lite: 1.0.30001810
+      electron-to-chromium: 1.5.420
+      node-releases: 2.0.54
+      update-browserslist-db: 1.3.2(browserslist@4.28.8)
 
   buffer@4.9.2:
     dependencies:
@@ -3714,6 +3718,8 @@ snapshots:
 
   caniuse-lite@1.0.30001800: {}
 
+  caniuse-lite@1.0.30001810: {}
+
   chai@6.2.2: {}
 
   chalk@4.1.2:
@@ -3816,7 +3822,7 @@ snapshots:
       es-errors: 1.3.0
       gopd: 1.2.0
 
-  electron-to-chromium@1.5.385: {}
+  electron-to-chromium@1.5.420: {}
 
   emoji-regex@9.2.2: {}
 
@@ -3976,8 +3982,8 @@ snapshots:
       '@typescript-eslint/parser': 8.62.1(eslint@9.39.4)(typescript@5.9.3)
       eslint: 9.39.4
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@9.39.4)
-      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4)
+      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint@9.39.4))(eslint@9.39.4)
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint@9.39.4))(eslint@9.39.4))(eslint@9.39.4)
       eslint-plugin-jsx-a11y: 6.10.2(eslint@9.39.4)
       eslint-plugin-react: 7.37.5(eslint@9.39.4)
       eslint-plugin-react-hooks: 5.2.0(eslint@9.39.4)
@@ -3996,7 +4002,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0)(eslint@9.39.4):
+  eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint@9.39.4))(eslint@9.39.4):
     dependencies:
       '@nolyfill/is-core-module': 1.0.39
       debug: 4.4.3
@@ -4007,22 +4013,22 @@ snapshots:
       tinyglobby: 0.2.17
       unrs-resolver: 1.12.2
     optionalDependencies:
-      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4)
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint@9.39.4))(eslint@9.39.4))(eslint@9.39.4)
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.14.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4):
+  eslint-module-utils@2.14.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint@9.39.4))(eslint@9.39.4))(eslint@9.39.4):
     dependencies:
       debug: 3.2.7
     optionalDependencies:
       '@typescript-eslint/parser': 8.62.1(eslint@9.39.4)(typescript@5.9.3)
       eslint: 9.39.4
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@9.39.4)
+      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint@9.39.4))(eslint@9.39.4)
     transitivePeerDependencies:
       - supports-color
 
-  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4):
+  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint@9.39.4))(eslint@9.39.4))(eslint@9.39.4):
     dependencies:
       '@rtsao/scc': 1.1.0
       array-includes: 3.1.9
@@ -4033,7 +4039,7 @@ snapshots:
       doctrine: 2.1.0
       eslint: 9.39.4
       eslint-import-resolver-node: 0.3.10
-      eslint-module-utils: 2.14.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4)
+      eslint-module-utils: 2.14.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.62.1(eslint@9.39.4)(typescript@5.9.3))(eslint@9.39.4))(eslint@9.39.4))(eslint@9.39.4)
       hasown: 2.0.4
       is-core-module: 2.16.2
       is-glob: 4.0.3
@@ -4637,7 +4643,7 @@ snapshots:
     dependencies:
       whatwg-url: 5.0.0
 
-  node-releases@2.0.50: {}
+  node-releases@2.0.54: {}
 
   object-assign@4.1.1: {}
 
@@ -5187,9 +5193,9 @@ snapshots:
       '@unrs/resolver-binding-win32-ia32-msvc': 1.12.2
       '@unrs/resolver-binding-win32-x64-msvc': 1.12.2
 
-  update-browserslist-db@1.2.3(browserslist@4.28.4):
+  update-browserslist-db@1.3.2(browserslist@4.28.8):
     dependencies:
-      browserslist: 4.28.4
+      browserslist: 4.28.8
       escalade: 3.2.0
       picocolors: 1.1.1
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.301.9",
+  "version": "0.301.11",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",

package/scripts/claim.sh

@@ -43,6 +43,7 @@
 #   sh scripts/claim.sh 1234 --as <token> --check    # report only, change nothing
 #   sh scripts/claim.sh 1234 --as <token> -R owner/repo
 #   sh scripts/claim.sh 1234 --release <token>       # only the holder may clear it
+#   sh scripts/claim.sh 1234 --reaffirm <token>      # keep a claim alive past session-stop
 #   sh scripts/claim.sh --guard <branch>             # pre-push gate — see below
 #
 #   0  free — and claimed, unless --check
@@ -148,6 +149,29 @@
 #     collision caught early (see "What it cannot do" above). Set
 #     `BIFFO_CLAIM_STRICT=1` to make this script itself collapse cannot-tell
 #     into exit 1 instead, for anyone who would rather block than guess.
+#
+# ## `--reaffirm <token>` — keep a claim alive past this session's own stop (#1849)
+#
+# AGENTS.md's own convention is "release it... on merge, or if you stop" —
+# every session, unconditionally, regardless of what it just shipped. That is
+# right for the overwhelming majority of sessions, and wrong for the one that
+# ships a `Refs`-only PR whose whole point is a multi-day review window during
+# which the issue must stay claimed. Nothing distinguished the two: a PR could
+# write, in its own body, "nothing here touches that label or that claim", and
+# the same session's ordinary end-of-session `--release` fired seconds later
+# regardless — the written promise and the actual mechanism disagreed, and
+# nothing reconciled them (biffo-template#1849; the same guard-vs-authority
+# shape already tracked with 8 other instances in this estate).
+#
+# `--reaffirm` gives that session something to actually RUN as a required last
+# step, instead of a promise the next reader has to take on faith. It is
+# deliberately not a fresh claim: it always re-applies the label and posts a
+# comment for `$HOLDER`, whether or not the four signals below would call the
+# issue free — that is the point, the caller is asserting "stays taken", not
+# asking "is this taken". The one thing it refuses is overwriting a DIFFERENT
+# live holder's claim: if the label is already present and the claim-holder
+# comment names someone other than `$HOLDER`, it exits 1 exactly like a
+# mismatched `--release`, rather than silently taking over.
 
 set -u
 
@@ -155,6 +179,7 @@ ISSUE=""
 REPO=""
 HOLDER=""
 RELEASE=""
+REAFFIRM=""
 HOLDER_MARK="claim-holder:"
 BRANCH_MARK="claim-branch:"
 CHECK_ONLY=""
@@ -237,6 +262,17 @@ while [ $# -gt 0 ]; do
         *) HOLDER="$2"; shift 2 ;;
       esac
       ;;
+    --reaffirm)
+      # Mirrors --release's own parsing exactly, and for the identical reason
+      # (#826, the FLAG-IS-NOT-A-TOKEN fix above): `--reaffirm --as <token>`
+      # must not swallow `--as` as the token and push the real token into
+      # ISSUE's positional slot.
+      REAFFIRM=1
+      case "${2:-}" in
+        -*|'') shift ;;
+        *) HOLDER="$2"; shift 2 ;;
+      esac
+      ;;
     --guard)
       [ $# -ge 2 ] || missing_value "$1"
       GUARD_BRANCH="$2"
@@ -255,7 +291,7 @@ while [ $# -gt 0 ]; do
       # Refusing here, at the point the flag is actually unrecognized, says
       # what is really wrong instead of a confusing knock-on error.
       echo "${RED}claim: unrecognized flag '$1'${OFF}" >&2
-      echo "${DIM}  Known flags: -R/--repo, --check, --as, --release, --guard, -h/--help.${OFF}" >&2
+      echo "${DIM}  Known flags: -R/--repo, --check, --as, --release, --reaffirm, --guard, -h/--help.${OFF}" >&2
       exit 2
       ;;
     *)
@@ -1029,6 +1065,65 @@ if [ "$state" != "OPEN" ]; then
   exit 1
 fi
 
+# --- --reaffirm: keep the claim taken, regardless of what the four signals
+# below would say (#1849) --------------------------------------------------
+#
+# Runs here rather than as an early short-circuit like --release/--guard,
+# specifically so it gets the SAME "--as <token> is required" gate those two
+# are exempted from (above) and the same OPEN-issue check just above: a
+# reaffirm with no identifying token, or of an issue that is already closed,
+# should fail exactly the way a fresh claim would, not slip through on a
+# lighter check because it front-ran the validation.
+#
+# Deliberately does NOT consult the lease/label/PR/branch signals below to
+# decide whether to act — a reaffirm is an assertion ("this stays taken"),
+# not a question ("is this taken"). The one thing it will not do is clobber
+# a claim that already names a DIFFERENT live holder: that would turn
+# "restore my own claim" into "silently steal someone else's".
+if [ -n "$REAFFIRM" ]; then
+  case ",$labels," in
+    *",$LABEL,"*)
+      claim_held_by "$ISSUE" "$HOLDER"
+      _reaffirm_held=$?
+      if [ "$_reaffirm_held" -eq 1 ]; then
+        echo "${RED}claim: #$ISSUE is already labeled '$LABEL', held by someone other than '$HOLDER'.${OFF}" >&2
+        echo "${DIM}  --reaffirm restores YOUR OWN claim; it does not take over someone else's.${OFF}" >&2
+        echo "${DIM}  If that claim is genuinely stale, say so in a comment and steal it via${OFF}" >&2
+        echo "${DIM}  the ordinary claim path instead (AGENTS.md: over an hour, no activity).${OFF}" >&2
+        exit 1
+      fi
+      if [ "$_reaffirm_held" -eq 2 ]; then
+        echo "${RED}claim: cannot tell whether #$ISSUE's '$LABEL' label is yours${OFF} — comments unreadable." >&2
+        echo "${DIM}  Not reaffirming on an unreadable read: that could overwrite someone else's claim.${OFF}" >&2
+        exit 2
+      fi
+      ;;
+  esac
+
+  # Make sure the label exists before applying it — same idempotent,
+  # non-fatal create as the fresh-claim path below.
+  gh_label create "$LABEL" \
+    -c FBCA04 \
+    -d "Claimed by a running agent session -- do not start work on this" \
+    >/dev/null 2>&1 || true
+
+  _claim_branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo '')
+  case "$_claim_branch" in
+    '' | HEAD) _claim_branch='' ;;
+  esac
+  gh_issue edit "$ISSUE" --add-label "$LABEL" >/dev/null 2>&1 || {
+    echo "${RED}claim: could not apply the '$LABEL' label.${OFF}" >&2
+    echo "${DIM}  Not reaffirmed — do not treat #$ISSUE as still claimed.${OFF}" >&2
+    exit 2
+  }
+  gh_issue comment "$ISSUE" \
+    --body "Reaffirmed at $(date -u +%FT%TZ) by \`$(git config user.name 2>/dev/null || echo agent)\`. ${HOLDER_MARK}${HOLDER}${_claim_branch:+ ${BRANCH_MARK}${_claim_branch}} This is a REAFFIRMED claim, not a fresh one and not a release: a PR or session referencing this issue has stated it must stay claimed beyond this session's own lifetime (e.g. a review-window experiment, or a Refs-only PR that is not yet finished). Do not run --release on ordinary session-stop while that stated condition holds — release only once it genuinely resolves." \
+    >/dev/null 2>&1
+
+  echo "${GREEN}Reaffirmed.${OFF} ${DIM}(#$ISSUE stays claimed by $HOLDER)${OFF}"
+  exit 0
+fi
+
 # --- 0.5. THE LEASE. The one authority for "is this being worked on" ---------
 #
 # ADR-0008: "The lease decides. A unit with no live lease is available, whatever