@biffo/cli 0.304.1 → 0.304.3

package/dist/index.js

@@ -717,12 +717,28 @@ function checkCoreOwnership({
   isInstance,
   branch = "",
   commitMessage = "",
-  warnOnly = []
+  warnOnly = [],
+  templateShippedPaths = null
 }) {
-  const empty = { blocked: [], warned: [], divergenceReason: null, convergenceReason: null };
+  const empty = {
+    blocked: [],
+    warned: [],
+    divergenceReason: null,
+    convergenceReason: null,
+    knownOrphans: []
+  };
   if (!isInstance) return { skipped: "template", ...empty };
   if (branch.startsWith(UPGRADE_BRANCH_PREFIX)) return { skipped: "upgrade-branch", ...empty };
-  const templateOwned = changedFiles.filter((f) => isTemplateOwned(f, manifest));
+  const manifestTemplateOwned = changedFiles.filter((f) => isTemplateOwned(f, manifest));
+  const knownOrphans = [];
+  const templateOwned = [];
+  for (const path of manifestTemplateOwned) {
+    if (templateShippedPaths != null && !templateShippedPaths.has(path)) {
+      knownOrphans.push(path);
+    } else {
+      templateOwned.push(path);
+    }
+  }
   const acknowledged = (path) => warnOnly.filter((entry) => path.startsWith(entry.prefix)).reduce(
     (best, entry) => !best || entry.prefix.length > best.prefix.length ? entry : best,
     void 0
@@ -743,7 +759,8 @@ function checkCoreOwnership({
         blocked: [],
         warned,
         divergenceReason,
-        convergenceReason: null
+        convergenceReason: null,
+        knownOrphans
       };
     }
     if (convergenceReason !== null) {
@@ -752,7 +769,8 @@ function checkCoreOwnership({
         blocked: [],
         warned,
         divergenceReason: null,
-        convergenceReason
+        convergenceReason,
+        knownOrphans
       };
     }
   }
@@ -761,7 +779,8 @@ function checkCoreOwnership({
     blocked: offending,
     warned,
     divergenceReason: null,
-    convergenceReason: null
+    convergenceReason: null,
+    knownOrphans
   };
 }
 
@@ -12255,6 +12274,37 @@ async function runCoreDirectPathsCheck(opts = {}) {
   console.log(`\u2713 core-direct-paths guard: ${report.summary}`);
 }
 
+// src/lib/template-shipped-paths.ts
+var TEMPLATE_UPSTREAM_OWNER = "keiranholloway";
+var TEMPLATE_UPSTREAM_REPO = "biffo-template";
+var TEMPLATE_UPSTREAM_BRANCH = "dev";
+var defaultRunner = async (args, cwd) => {
+  const result = await execa("git", args, { cwd, reject: false, timeout: 15e3 });
+  return { stdout: String(result.stdout ?? ""), exitCode: result.exitCode ?? null };
+};
+async function fetchTemplateShippedPaths(repoRoot, runner = defaultRunner) {
+  const url = `https://github.com/${TEMPLATE_UPSTREAM_OWNER}/${TEMPLATE_UPSTREAM_REPO}.git`;
+  let fetched;
+  try {
+    fetched = await runner(
+      ["fetch", "--depth", "1", "--quiet", url, TEMPLATE_UPSTREAM_BRANCH],
+      repoRoot
+    );
+  } catch {
+    return null;
+  }
+  if (fetched.exitCode !== 0) return null;
+  let tree;
+  try {
+    tree = await runner(["ls-tree", "-r", "--name-only", "FETCH_HEAD"], repoRoot);
+  } catch {
+    return null;
+  }
+  if (tree.exitCode !== 0) return null;
+  const paths = tree.stdout.split("\n").map((line) => line.trim()).filter(Boolean);
+  return paths.length > 0 ? new Set(paths) : null;
+}
+
 // src/scripts/check-core-ownership.ts
 var BOLD = "\x1B[1m";
 var DIM = "\x1B[2m";
@@ -12310,14 +12360,29 @@ async function runOwnershipCheck(argv) {
     reject: false
   });
   const branch = resolveBranch(process.env, gitBranch);
+  const templateShippedPaths = staged ? null : await fetchTemplateShippedPaths(root);
+  if (!staged && templateShippedPaths === null) {
+    console.error(
+      `${YELLOW}\u26A0 core ownership guard: could not fetch biffo-template's dev tree (offline, network failure, or timeout) \u2014 falling back to the manifest prefix list alone, which cannot tell an instance-only file from a real template file under the same prefix (#1912).${OFF}`
+    );
+  }
   const result = checkCoreOwnership({
     changedFiles,
     manifest: readCoreManifest(root),
     isInstance: true,
     branch,
     commitMessage,
-    warnOnly: readDivergenceConfig(root).warnOnly
+    warnOnly: readDivergenceConfig(root).warnOnly,
+    templateShippedPaths
   });
+  if (result.knownOrphans.length > 0) {
+    console.log(
+      `${DIM}\u2139 ${result.knownOrphans.length} path(s) matched a template-owned prefix, but biffo-template's dev branch does not ship them \u2014 treated as instance-owned, no Core-Divergence trailer needed (#1912):${OFF}`
+    );
+    for (const path of result.knownOrphans) {
+      console.log(`    ${DIM}${path}${OFF}`);
+    }
+  }
   for (const { path, entry } of result.warned) {
     console.error(
       `${YELLOW}\u26A0 ${path}${OFF} ${DIM}\u2014 known divergence in ${entry.prefix} (${entry.upstream}); still conflicts at the next core upgrade.${OFF}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.304.1",
+  "version": "0.304.3",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",

package/scripts/verify.sh

@@ -75,6 +75,38 @@
 
 set -u
 
+# Orphaned-scratch backstop (#1930). Every check below that creates a temp
+# dir/file already cleans it up inline on its own pass/fail paths (an
+# explicit `rm -rf`/`rm -f`, sometimes a per-function trap) -- that cleanup is
+# left exactly as it is, as defensive belt-and-braces. What none of them cover
+# is verify.sh itself dying abnormally (SIGTERM from a CI timeout, an
+# interrupted local Ctrl-C, `kill`) partway through one of those functions,
+# before its own inline cleanup line is reached. `gitleaks_tracked_only`'s
+# `_gl_dir` has the largest such window: mirror-copy every tracked file, then
+# a full `gitleaks detect` run, all between the `mktemp -d` and the `rm -rf`
+# that only fires if the function returns normally.
+#
+# That gap is exactly what accumulated hundreds of stale `bt-verify`,
+# `biffo-template-verify`, `dev-check-*` and `tmp.*` scratch dirs in /tmp with
+# no eviction, driving it to 100% inode usage and breaking every `fleet.sh`
+# command that writes a temp file.
+#
+# Idiom matches the other trap-using scripts in this directory
+# (`js-dependency-audit.sh`, `shared-sync.sh`): accumulate every path this run
+# creates in one variable, and let a single EXIT/HUP/INT/TERM trap sweep all
+# of them however the script leaves. Declared here, at the very top, so the
+# trap has a function to call no matter how early an abnormal exit happens.
+_VERIFY_TMP_PATHS=""
+_verify_track_tmp() {
+  _VERIFY_TMP_PATHS="$_VERIFY_TMP_PATHS $1"
+}
+_verify_cleanup_tmp() {
+  # shellcheck disable=SC2086  -- word-splitting is the point: one or more
+  # space-separated paths accumulated over the run.
+  [ -n "$_VERIFY_TMP_PATHS" ] && rm -rf $_VERIFY_TMP_PATHS
+}
+trap _verify_cleanup_tmp EXIT HUP INT TERM
+
 LIST=""
 [ "${1:-}" = "--list" ] && LIST=1
 
@@ -537,6 +569,7 @@ run_check() {
     return 0
   fi
   start=$(date +%s)
+  _verify_track_tmp "/tmp/biffo-verify.$$"
   if "$@" >"/tmp/biffo-verify.$$" 2>&1; then
     PASSED="$PASSED $name"
     LAST_CHECK_SECONDS=$(($(date +%s) - start))
@@ -651,6 +684,7 @@ run_check_js() {
     return 0
   fi
   start=$(date +%s)
+  _verify_track_tmp "/tmp/biffo-verify.$$"
   if "$@" >"/tmp/biffo-verify.$$" 2>&1; then
     PASSED="$PASSED $name"
     LAST_CHECK_SECONDS=$(($(date +%s) - start))
@@ -1027,6 +1061,7 @@ pg_xdist_ready() {
 
 pg_test_run() {
   _out="/tmp/biffo-verify-pg.$$"
+  _verify_track_tmp "$_out"
   _pg_started=$(date +%s)
 
   if pg_xdist_ready "$1"; then
@@ -1287,6 +1322,7 @@ else
       echo pg_test_run "$_pg_dir" "$_pg_rel"
     else
       _pg_check_start=$(date +%s)
+      _verify_track_tmp "/tmp/biffo-verify-pg-check.$$"
       # shellcheck disable=SC2086
       pg_test_run "$_pg_dir" "$_pg_rel" >"/tmp/biffo-verify-pg-check.$$" 2>&1
       _pg_check_rc=$?
@@ -1567,6 +1603,7 @@ fi
 # existing path-based `.gitleaks.toml` allowlist entries keep working unchanged.
 gitleaks_tracked_only() {
   _gl_dir=$(mktemp -d "${TMPDIR:-/tmp}/biffo-gitleaks.XXXXXX") || return 1
+  _verify_track_tmp "$_gl_dir"
   _gl_root=$(git rev-parse --show-toplevel) || {
     rm -rf "$_gl_dir"
     return 1