@biffo/cli 0.312.2 → 0.312.4

package/_skeletons/sibling-template/.github/workflows/ci.yml

@@ -109,6 +109,44 @@ jobs:
       - name: Scale drift guard
         if: ${{ !cancelled() }}
         run: pnpm exec biffo-scale-guard
+      # An unsuppressed `aws lambda update-function-*` prints the whole
+      # resolved function configuration -- every env var, plaintext -- into
+      # the Actions log, and the response is never consumed (biffo-template
+      # #334). deploy.yml's own `aws lambda update-function-code` call already
+      # follows the convention (--output text --query 'LastUpdateStatus'), but
+      # nothing in this repo's own CI asserted it would keep doing so: the
+      # guard existed only in biffo-template's root ci.yml, which scans this
+      # skeleton's tree from the template side but never runs inside a
+      # scaffolded sibling's own CI, so a regression added directly to a live
+      # sibling's deploy.yml was regression-proof only by a human reading the
+      # diff (#1968). `scripts/biffo.sh` resolves the version-pinned CLI this
+      # sibling was stamped with at birth (#1109), same as every other guard
+      # invocation in this job.
+      - name: Lambda output guard
+        if: ${{ !cancelled() }}
+        # This job's working-directory default is apps/frontend (top of this
+        # job), but scripts/biffo.sh lives at the repo root -- same relative-
+        # path convention as the js-audit job's own
+        # `sh ../../scripts/js-dependency-audit.sh` below. A bare
+        # `scripts/biffo.sh` here fails unconditionally with "No such file",
+        # on every run, regardless of whether there is a real
+        # lambda-output/terraform-input violation (biffo-template#1983).
+        run: sh ../../scripts/biffo.sh check lambda-output
+      # A Terraform subcommand that can prompt for an unresolved variable
+      # without -input=false, or a workflow running Terraform at all without
+      # TF_INPUT set as a backstop, hangs forever on a GitHub Actions runner --
+      # there is no stdin to answer the prompt with (biffo-template#322).
+      # `-auto-approve` does NOT prevent this. Same gap as the lambda-output
+      # guard above: deploy.yml's terraform invocations already pass
+      # `-input=false` and the workflow-level `TF_INPUT: '0'` above already
+      # exists as a backstop, but nothing in this repo's own CI asserted
+      # either would stay true (#1968).
+      - name: Terraform-input guard
+        if: ${{ !cancelled() }}
+        # Same cwd fix as the Lambda output guard step above -- this job's
+        # working-directory default is apps/frontend, and scripts/biffo.sh
+        # lives at the repo root (biffo-template#1983).
+        run: sh ../../scripts/biffo.sh check terraform-input
 
   e2e:
     name: E2E (Playwright)

package/dist/index.js

@@ -2838,12 +2838,124 @@ function parseBodyChangeDeclaration(content) {
   }
   return { classification: value[1], reason: value[2] };
 }
+var BODY_CHANGE_LINE_ONLY_RE = /^[ \t]*# biffo:body-change:[ \t]*(.*)$/;
+function pythonStatementGroups(lines, docLineMask) {
+  const groupId = new Array(lines.length);
+  let depth = 0;
+  let quote = null;
+  let currentGroup = -1;
+  for (let li = 0; li < lines.length; li++) {
+    if (docLineMask[li]) {
+      groupId[li] = currentGroup;
+      continue;
+    }
+    if (depth === 0 && quote === null) currentGroup++;
+    groupId[li] = currentGroup;
+    const line = lines[li];
+    for (let ci = 0; ci < line.length; ci++) {
+      const ch = line[ci];
+      if (quote) {
+        if (ch === "\\") {
+          ci++;
+          continue;
+        }
+        if (ch === quote) quote = null;
+        continue;
+      }
+      if (ch === '"' || ch === "'") {
+        quote = ch;
+        continue;
+      }
+      if (ch === "#") break;
+      if (ch === "(" || ch === "[" || ch === "{") depth++;
+      else if (ch === ")" || ch === "]" || ch === "}") depth = Math.max(0, depth - 1);
+    }
+  }
+  return groupId;
+}
+var MAX_DIFF_CELLS = 4e3 * 4e3;
+function computeMatchedNewLineIndices(oldLines, newLines) {
+  const n = oldLines.length;
+  const m = newLines.length;
+  if (n * m > MAX_DIFF_CELLS) return /* @__PURE__ */ new Set();
+  const stride = m + 1;
+  const dp = new Uint32Array((n + 1) * stride);
+  for (let i2 = n - 1; i2 >= 0; i2--) {
+    for (let j2 = m - 1; j2 >= 0; j2--) {
+      dp[i2 * stride + j2] = oldLines[i2] === newLines[j2] ? dp[(i2 + 1) * stride + (j2 + 1)] + 1 : Math.max(dp[(i2 + 1) * stride + j2], dp[i2 * stride + (j2 + 1)]);
+    }
+  }
+  const matchedNew = /* @__PURE__ */ new Set();
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (oldLines[i] === newLines[j]) {
+      matchedNew.add(j);
+      i++;
+      j++;
+    } else if (dp[(i + 1) * stride + j] >= dp[i * stride + (j + 1)]) {
+      i++;
+    } else {
+      j++;
+    }
+  }
+  return matchedNew;
+}
+function findEditScopedBodyChangeDeclarations(oldContent, newContent) {
+  const oldLines = oldContent.split("\n");
+  const newLines = newContent.split("\n");
+  const matchedNew = computeMatchedNewLineIndices(oldLines, newLines);
+  const newDocMask = pythonDocstringLineMask(newContent);
+  const groupIds = pythonStatementGroups(newLines, newDocMask);
+  const oldMarkerLines = new Set(oldLines.filter((line) => BODY_CHANGE_LINE_ONLY_RE.test(line)));
+  const results = [];
+  let i = 0;
+  while (i < newLines.length) {
+    const gid = groupIds[i];
+    let end = i;
+    while (end < newLines.length && groupIds[end] === gid) end++;
+    let needsDeclaration = false;
+    for (let k = i; k < end; k++) {
+      if (!matchedNew.has(k) && isSubstantiveLine(newLines[k], newDocMask[k] ?? false)) {
+        needsDeclaration = true;
+        break;
+      }
+    }
+    if (needsDeclaration) {
+      const aboveIdx = i - 1;
+      const above = aboveIdx >= 0 ? newLines[aboveIdx] : null;
+      const aboveMatch = above !== null ? BODY_CHANGE_LINE_ONLY_RE.exec(above) : null;
+      if (!aboveMatch) {
+        results.push({ declaration: null, staleOnly: false });
+      } else if (oldMarkerLines.has(above)) {
+        results.push({ declaration: null, staleOnly: true });
+      } else {
+        const rest = (aboveMatch[1] ?? "").trim();
+        const value = BODY_CHANGE_VALUE_RE.exec(rest);
+        if (!value) {
+          throw new Error(
+            `Malformed ${BODY_CHANGE_MARKER} marker: expected "${BODY_CHANGE_MARKER} replay-safe \u2014 <reason>" or "${BODY_CHANGE_MARKER} outcome-changing \u2014 <reason>", got "${rest}".`
+          );
+        }
+        results.push({
+          declaration: {
+            classification: value[1],
+            reason: value[2]
+          },
+          staleOnly: false
+        });
+      }
+    }
+    i = end;
+  }
+  return results;
+}
 var DOCSTRING_OPEN_RE = /^[rRuU]?("""|''')/;
 var DEF_OR_CLASS_RE = /^(async\s+def|def|class)\b/;
 var HEADER_END_RE = /:\s*(#.*)?$/;
-function stripPythonDocstrings(source) {
+function pythonDocstringLineMask(source) {
   const lines = source.split("\n");
-  const out = [];
+  const mask = new Array(lines.length).fill(false);
   let expectDocstring = true;
   let inHeader = false;
   let i = 0;
@@ -2851,7 +2963,6 @@ function stripPythonDocstrings(source) {
     const line = lines[i];
     const trimmed = line.trim();
     if (trimmed === "" || trimmed.startsWith("#")) {
-      out.push(line);
       i++;
       continue;
     }
@@ -2859,13 +2970,20 @@ function stripPythonDocstrings(source) {
     if (open) {
       const delim = open[1];
       expectDocstring = false;
+      mask[i] = true;
       if (trimmed.slice(open[0].length).includes(delim)) {
         i++;
         continue;
       }
       i++;
-      while (i < lines.length && !lines[i].includes(delim)) i++;
-      if (i < lines.length) i++;
+      while (i < lines.length && !lines[i].includes(delim)) {
+        mask[i] = true;
+        i++;
+      }
+      if (i < lines.length) {
+        mask[i] = true;
+        i++;
+      }
       continue;
     }
     if (inHeader || DEF_OR_CLASS_RE.test(trimmed)) {
@@ -2875,17 +2993,25 @@ function stripPythonDocstrings(source) {
     } else {
       expectDocstring = false;
     }
-    out.push(line);
     i++;
   }
-  return out.join("\n");
+  return mask;
 }
 function migrationBodyHash(content) {
-  const normalised = stripPythonDocstrings(content).split("\n").map((line) => line.trimEnd()).filter(
-    (line) => !REVISION_RE.test(line) && !DOWN_REVISION_RE.test(line) && !line.trimStart().startsWith("#") && line !== ""
-  ).join("\n");
+  const lines = content.split("\n");
+  const docMask = pythonDocstringLineMask(content);
+  const normalised = lines.filter((line, i) => isSubstantiveLine(line, docMask[i] ?? false)).map((line) => line.trimEnd()).join("\n");
   return createHash("sha256").update(normalised).digest("hex");
 }
+function isSubstantiveLine(rawLine, inDocstring) {
+  if (inDocstring) return false;
+  const line = rawLine.trimEnd();
+  if (line === "") return false;
+  if (line.trimStart().startsWith("#")) return false;
+  if (REVISION_RE.test(line)) return false;
+  if (DOWN_REVISION_RE.test(line)) return false;
+  return true;
+}
 function migrationSlug(file) {
   return file.replace(/\.py$/, "").replace(/^[0-9a-f]+_/i, "");
 }
@@ -13457,6 +13583,7 @@ function checkMigrationBodyChangeMarkers(diffs) {
   const unchanged = [];
   const declared = [];
   const violations = [];
+  let examinedChanged = 0;
   for (const d of diffs) {
     if (d.status === "added") {
       exemptAdded.push(d.file);
@@ -13471,24 +13598,39 @@ function checkMigrationBodyChangeMarkers(diffs) {
       unchanged.push(d.file);
       continue;
     }
-    let decl;
+    examinedChanged++;
+    let results;
     try {
-      decl = parseBodyChangeDeclaration(d.newContent ?? "");
+      results = findEditScopedBodyChangeDeclarations(d.oldContent ?? "", d.newContent ?? "");
     } catch (err) {
       violations.push({ file: d.file, reason: err.message });
       continue;
     }
-    if (decl) {
-      declared.push({ file: d.file, classification: decl.classification });
-    } else {
+    if (results.length === 0) {
       violations.push({
         file: d.file,
-        reason: `this edit changes the migration's hashed body (DDL, not just a docstring or comment) with no \`${BODY_CHANGE_MARKER}\` declaration.`
+        reason: "this edit changes the migration's hashed body, but no specific statement could be isolated to require a declaration from \u2014 reported as undeclared rather than silently passed."
       });
+      continue;
+    }
+    for (const result of results) {
+      if (result.declaration) {
+        declared.push({ file: d.file, classification: result.declaration.classification });
+      } else if (result.staleOnly) {
+        violations.push({
+          file: d.file,
+          reason: `this edit changes the migration's hashed body (DDL, not just a docstring or comment), and the only \`${BODY_CHANGE_MARKER}\` marker directly above it already existed, unchanged, before this edit \u2014 a stale declaration left over from a different change does not cover this one.`
+        });
+      } else {
+        violations.push({
+          file: d.file,
+          reason: `this edit changes the migration's hashed body (DDL, not just a docstring or comment) with no \`${BODY_CHANGE_MARKER}\` declaration directly above it.`
+        });
+      }
     }
   }
   return {
-    examined: unchanged.length + declared.length + violations.length,
+    examined: unchanged.length + examinedChanged,
     exemptAdded,
     unchanged,
     declared,
@@ -13612,6 +13754,10 @@ ${BOLD2}What to do${OFF2}
   converges it. Neither label is enforced yet (#751 is reporting-only, pending
   more examples) \u2014 but recording it now is what lets that decision be made
   later instead of never.
+
+  A marker left over from an earlier, already-merged edit to this same file
+  does ${DIM2}not${OFF2} cover a new one \u2014 add a fresh marker beside THIS change,
+  even if the classification happens to match (#751 precondition D).
 `);
   process.exit(1);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.312.2",
+  "version": "0.312.4",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",