@biffo/cli 0.312.3 → 0.312.5

package/_skeletons/plugin-template/.githooks/pre-push

@@ -166,4 +166,22 @@ fi
 # without the file passed its pre-push having checked nothing, which is the
 # same defect one level up from the one #855 recorded. A gate that cannot run
 # is not a gate that passed.
-exec sh scripts/biffo.sh verify
+#
+# Not a bare `exec` (biffo-template#1985): git's own generic
+# "error: failed to push some refs" line is printed by git itself, after this
+# hook exits, and is the literal last thing in a truncated-tail read of a long
+# agent transcript. Nothing distinguished it from a real auth/network
+# rejection -- three same-day dispatches on tabsii-platform#1403 diagnosed and
+# "fixed" a token before noticing the real cause was a local gate. verify.sh's
+# own failure text (above) already names the cause; this adds one more line,
+# deliberately placed as close as this hook can get to git's trailing output,
+# so a reader who only sees the last few lines still sees it.
+sh scripts/biffo.sh verify
+verify_status=$?
+if [ "$verify_status" -ne 0 ]; then
+  printf '\n\033[31m>>> pre-push: BLOCKED BY THE LOCAL GATE ABOVE, not by git or GitHub.\033[0m\n' >&2
+  printf '    See "verify failed:" above for which check(s) and why. Any\n' >&2
+  printf '    "failed to push some refs" line below this is git relaying that\n' >&2
+  printf '    same exit code -- it is not a separate rejection.\n' >&2
+fi
+exit "$verify_status"

package/_skeletons/sibling-template/.githooks/pre-push

@@ -166,4 +166,22 @@ fi
 # without the file passed its pre-push having checked nothing, which is the
 # same defect one level up from the one #855 recorded. A gate that cannot run
 # is not a gate that passed.
-exec sh scripts/biffo.sh verify
+#
+# Not a bare `exec` (biffo-template#1985): git's own generic
+# "error: failed to push some refs" line is printed by git itself, after this
+# hook exits, and is the literal last thing in a truncated-tail read of a long
+# agent transcript. Nothing distinguished it from a real auth/network
+# rejection -- three same-day dispatches on tabsii-platform#1403 diagnosed and
+# "fixed" a token before noticing the real cause was a local gate. verify.sh's
+# own failure text (above) already names the cause; this adds one more line,
+# deliberately placed as close as this hook can get to git's trailing output,
+# so a reader who only sees the last few lines still sees it.
+sh scripts/biffo.sh verify
+verify_status=$?
+if [ "$verify_status" -ne 0 ]; then
+  printf '\n\033[31m>>> pre-push: BLOCKED BY THE LOCAL GATE ABOVE, not by git or GitHub.\033[0m\n' >&2
+  printf '    See "verify failed:" above for which check(s) and why. Any\n' >&2
+  printf '    "failed to push some refs" line below this is git relaying that\n' >&2
+  printf '    same exit code -- it is not a separate rejection.\n' >&2
+fi
+exit "$verify_status"

package/dist/index.js

@@ -2838,12 +2838,124 @@ function parseBodyChangeDeclaration(content) {
   }
   return { classification: value[1], reason: value[2] };
 }
+var BODY_CHANGE_LINE_ONLY_RE = /^[ \t]*# biffo:body-change:[ \t]*(.*)$/;
+function pythonStatementGroups(lines, docLineMask) {
+  const groupId = new Array(lines.length);
+  let depth = 0;
+  let quote = null;
+  let currentGroup = -1;
+  for (let li = 0; li < lines.length; li++) {
+    if (docLineMask[li]) {
+      groupId[li] = currentGroup;
+      continue;
+    }
+    if (depth === 0 && quote === null) currentGroup++;
+    groupId[li] = currentGroup;
+    const line = lines[li];
+    for (let ci = 0; ci < line.length; ci++) {
+      const ch = line[ci];
+      if (quote) {
+        if (ch === "\\") {
+          ci++;
+          continue;
+        }
+        if (ch === quote) quote = null;
+        continue;
+      }
+      if (ch === '"' || ch === "'") {
+        quote = ch;
+        continue;
+      }
+      if (ch === "#") break;
+      if (ch === "(" || ch === "[" || ch === "{") depth++;
+      else if (ch === ")" || ch === "]" || ch === "}") depth = Math.max(0, depth - 1);
+    }
+  }
+  return groupId;
+}
+var MAX_DIFF_CELLS = 4e3 * 4e3;
+function computeMatchedNewLineIndices(oldLines, newLines) {
+  const n = oldLines.length;
+  const m = newLines.length;
+  if (n * m > MAX_DIFF_CELLS) return /* @__PURE__ */ new Set();
+  const stride = m + 1;
+  const dp = new Uint32Array((n + 1) * stride);
+  for (let i2 = n - 1; i2 >= 0; i2--) {
+    for (let j2 = m - 1; j2 >= 0; j2--) {
+      dp[i2 * stride + j2] = oldLines[i2] === newLines[j2] ? dp[(i2 + 1) * stride + (j2 + 1)] + 1 : Math.max(dp[(i2 + 1) * stride + j2], dp[i2 * stride + (j2 + 1)]);
+    }
+  }
+  const matchedNew = /* @__PURE__ */ new Set();
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (oldLines[i] === newLines[j]) {
+      matchedNew.add(j);
+      i++;
+      j++;
+    } else if (dp[(i + 1) * stride + j] >= dp[i * stride + (j + 1)]) {
+      i++;
+    } else {
+      j++;
+    }
+  }
+  return matchedNew;
+}
+function findEditScopedBodyChangeDeclarations(oldContent, newContent) {
+  const oldLines = oldContent.split("\n");
+  const newLines = newContent.split("\n");
+  const matchedNew = computeMatchedNewLineIndices(oldLines, newLines);
+  const newDocMask = pythonDocstringLineMask(newContent);
+  const groupIds = pythonStatementGroups(newLines, newDocMask);
+  const oldMarkerLines = new Set(oldLines.filter((line) => BODY_CHANGE_LINE_ONLY_RE.test(line)));
+  const results = [];
+  let i = 0;
+  while (i < newLines.length) {
+    const gid = groupIds[i];
+    let end = i;
+    while (end < newLines.length && groupIds[end] === gid) end++;
+    let needsDeclaration = false;
+    for (let k = i; k < end; k++) {
+      if (!matchedNew.has(k) && isSubstantiveLine(newLines[k], newDocMask[k] ?? false)) {
+        needsDeclaration = true;
+        break;
+      }
+    }
+    if (needsDeclaration) {
+      const aboveIdx = i - 1;
+      const above = aboveIdx >= 0 ? newLines[aboveIdx] : null;
+      const aboveMatch = above !== null ? BODY_CHANGE_LINE_ONLY_RE.exec(above) : null;
+      if (!aboveMatch) {
+        results.push({ declaration: null, staleOnly: false });
+      } else if (oldMarkerLines.has(above)) {
+        results.push({ declaration: null, staleOnly: true });
+      } else {
+        const rest = (aboveMatch[1] ?? "").trim();
+        const value = BODY_CHANGE_VALUE_RE.exec(rest);
+        if (!value) {
+          throw new Error(
+            `Malformed ${BODY_CHANGE_MARKER} marker: expected "${BODY_CHANGE_MARKER} replay-safe \u2014 <reason>" or "${BODY_CHANGE_MARKER} outcome-changing \u2014 <reason>", got "${rest}".`
+          );
+        }
+        results.push({
+          declaration: {
+            classification: value[1],
+            reason: value[2]
+          },
+          staleOnly: false
+        });
+      }
+    }
+    i = end;
+  }
+  return results;
+}
 var DOCSTRING_OPEN_RE = /^[rRuU]?("""|''')/;
 var DEF_OR_CLASS_RE = /^(async\s+def|def|class)\b/;
 var HEADER_END_RE = /:\s*(#.*)?$/;
-function stripPythonDocstrings(source) {
+function pythonDocstringLineMask(source) {
   const lines = source.split("\n");
-  const out = [];
+  const mask = new Array(lines.length).fill(false);
   let expectDocstring = true;
   let inHeader = false;
   let i = 0;
@@ -2851,7 +2963,6 @@ function stripPythonDocstrings(source) {
     const line = lines[i];
     const trimmed = line.trim();
     if (trimmed === "" || trimmed.startsWith("#")) {
-      out.push(line);
       i++;
       continue;
     }
@@ -2859,13 +2970,20 @@ function stripPythonDocstrings(source) {
     if (open) {
       const delim = open[1];
       expectDocstring = false;
+      mask[i] = true;
       if (trimmed.slice(open[0].length).includes(delim)) {
         i++;
         continue;
       }
       i++;
-      while (i < lines.length && !lines[i].includes(delim)) i++;
-      if (i < lines.length) i++;
+      while (i < lines.length && !lines[i].includes(delim)) {
+        mask[i] = true;
+        i++;
+      }
+      if (i < lines.length) {
+        mask[i] = true;
+        i++;
+      }
       continue;
     }
     if (inHeader || DEF_OR_CLASS_RE.test(trimmed)) {
@@ -2875,17 +2993,25 @@ function stripPythonDocstrings(source) {
     } else {
       expectDocstring = false;
     }
-    out.push(line);
     i++;
   }
-  return out.join("\n");
+  return mask;
 }
 function migrationBodyHash(content) {
-  const normalised = stripPythonDocstrings(content).split("\n").map((line) => line.trimEnd()).filter(
-    (line) => !REVISION_RE.test(line) && !DOWN_REVISION_RE.test(line) && !line.trimStart().startsWith("#") && line !== ""
-  ).join("\n");
+  const lines = content.split("\n");
+  const docMask = pythonDocstringLineMask(content);
+  const normalised = lines.filter((line, i) => isSubstantiveLine(line, docMask[i] ?? false)).map((line) => line.trimEnd()).join("\n");
   return createHash("sha256").update(normalised).digest("hex");
 }
+function isSubstantiveLine(rawLine, inDocstring) {
+  if (inDocstring) return false;
+  const line = rawLine.trimEnd();
+  if (line === "") return false;
+  if (line.trimStart().startsWith("#")) return false;
+  if (REVISION_RE.test(line)) return false;
+  if (DOWN_REVISION_RE.test(line)) return false;
+  return true;
+}
 function migrationSlug(file) {
   return file.replace(/\.py$/, "").replace(/^[0-9a-f]+_/i, "");
 }
@@ -13457,6 +13583,7 @@ function checkMigrationBodyChangeMarkers(diffs) {
   const unchanged = [];
   const declared = [];
   const violations = [];
+  let examinedChanged = 0;
   for (const d of diffs) {
     if (d.status === "added") {
       exemptAdded.push(d.file);
@@ -13471,24 +13598,39 @@ function checkMigrationBodyChangeMarkers(diffs) {
       unchanged.push(d.file);
       continue;
     }
-    let decl;
+    examinedChanged++;
+    let results;
     try {
-      decl = parseBodyChangeDeclaration(d.newContent ?? "");
+      results = findEditScopedBodyChangeDeclarations(d.oldContent ?? "", d.newContent ?? "");
     } catch (err) {
       violations.push({ file: d.file, reason: err.message });
       continue;
     }
-    if (decl) {
-      declared.push({ file: d.file, classification: decl.classification });
-    } else {
+    if (results.length === 0) {
       violations.push({
         file: d.file,
-        reason: `this edit changes the migration's hashed body (DDL, not just a docstring or comment) with no \`${BODY_CHANGE_MARKER}\` declaration.`
+        reason: "this edit changes the migration's hashed body, but no specific statement could be isolated to require a declaration from \u2014 reported as undeclared rather than silently passed."
       });
+      continue;
+    }
+    for (const result of results) {
+      if (result.declaration) {
+        declared.push({ file: d.file, classification: result.declaration.classification });
+      } else if (result.staleOnly) {
+        violations.push({
+          file: d.file,
+          reason: `this edit changes the migration's hashed body (DDL, not just a docstring or comment), and the only \`${BODY_CHANGE_MARKER}\` marker directly above it already existed, unchanged, before this edit \u2014 a stale declaration left over from a different change does not cover this one.`
+        });
+      } else {
+        violations.push({
+          file: d.file,
+          reason: `this edit changes the migration's hashed body (DDL, not just a docstring or comment) with no \`${BODY_CHANGE_MARKER}\` declaration directly above it.`
+        });
+      }
     }
   }
   return {
-    examined: unchanged.length + declared.length + violations.length,
+    examined: unchanged.length + examinedChanged,
     exemptAdded,
     unchanged,
     declared,
@@ -13612,6 +13754,10 @@ ${BOLD2}What to do${OFF2}
   converges it. Neither label is enforced yet (#751 is reporting-only, pending
   more examples) \u2014 but recording it now is what lets that decision be made
   later instead of never.
+
+  A marker left over from an earlier, already-merged edit to this same file
+  does ${DIM2}not${OFF2} cover a new one \u2014 add a fresh marker beside THIS change,
+  even if the classification happens to match (#751 precondition D).
 `);
   process.exit(1);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.312.3",
+  "version": "0.312.5",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",

package/scripts/verify.sh

@@ -1273,6 +1273,10 @@ elif [ -z "$PG_TEST_DSN" ]; then
       printf '  the pg-test lane above did not run. CI treats it as a required check, so a\n'
       printf '  push here would report green without having checked the thing most likely\n'
       printf '  to need it.\n\n'
+      printf '  This is NOT a credentials or network problem. It is a local gate refusing\n'
+      printf '  to push until the Postgres test lane runs. If git prints its own generic\n'
+      printf '  "failed to push some refs" line below this, that is git relaying THIS exit\n'
+      printf '  code -- not a rejection by GitHub or a sign of a bad token.\n\n'
       printf '  Get a DSN and re-run:\n'
       printf '    eval "$(sh scripts/pg-test-db.sh --export)"   # if this repo ships one\n'
       printf '    export BIFFO_TEST_PG_DSN=postgresql+asyncpg://user:pass@host:port/db\n\n'