@biffo/cli 0.312.4 → 0.313.0

package/_skeletons/plugin-template/.githooks/pre-push

@@ -166,4 +166,22 @@ fi
 # without the file passed its pre-push having checked nothing, which is the
 # same defect one level up from the one #855 recorded. A gate that cannot run
 # is not a gate that passed.
-exec sh scripts/biffo.sh verify
+#
+# Not a bare `exec` (biffo-template#1985): git's own generic
+# "error: failed to push some refs" line is printed by git itself, after this
+# hook exits, and is the literal last thing in a truncated-tail read of a long
+# agent transcript. Nothing distinguished it from a real auth/network
+# rejection -- three same-day dispatches on tabsii-platform#1403 diagnosed and
+# "fixed" a token before noticing the real cause was a local gate. verify.sh's
+# own failure text (above) already names the cause; this adds one more line,
+# deliberately placed as close as this hook can get to git's trailing output,
+# so a reader who only sees the last few lines still sees it.
+sh scripts/biffo.sh verify
+verify_status=$?
+if [ "$verify_status" -ne 0 ]; then
+  printf '\n\033[31m>>> pre-push: BLOCKED BY THE LOCAL GATE ABOVE, not by git or GitHub.\033[0m\n' >&2
+  printf '    See "verify failed:" above for which check(s) and why. Any\n' >&2
+  printf '    "failed to push some refs" line below this is git relaying that\n' >&2
+  printf '    same exit code -- it is not a separate rejection.\n' >&2
+fi
+exit "$verify_status"

package/_skeletons/sibling-template/.githooks/pre-push

@@ -166,4 +166,22 @@ fi
 # without the file passed its pre-push having checked nothing, which is the
 # same defect one level up from the one #855 recorded. A gate that cannot run
 # is not a gate that passed.
-exec sh scripts/biffo.sh verify
+#
+# Not a bare `exec` (biffo-template#1985): git's own generic
+# "error: failed to push some refs" line is printed by git itself, after this
+# hook exits, and is the literal last thing in a truncated-tail read of a long
+# agent transcript. Nothing distinguished it from a real auth/network
+# rejection -- three same-day dispatches on tabsii-platform#1403 diagnosed and
+# "fixed" a token before noticing the real cause was a local gate. verify.sh's
+# own failure text (above) already names the cause; this adds one more line,
+# deliberately placed as close as this hook can get to git's trailing output,
+# so a reader who only sees the last few lines still sees it.
+sh scripts/biffo.sh verify
+verify_status=$?
+if [ "$verify_status" -ne 0 ]; then
+  printf '\n\033[31m>>> pre-push: BLOCKED BY THE LOCAL GATE ABOVE, not by git or GitHub.\033[0m\n' >&2
+  printf '    See "verify failed:" above for which check(s) and why. Any\n' >&2
+  printf '    "failed to push some refs" line below this is git relaying that\n' >&2
+  printf '    same exit code -- it is not a separate rejection.\n' >&2
+fi
+exit "$verify_status"

package/dist/index.js

@@ -16299,7 +16299,7 @@ function rawArgsAfter(subcommand) {
 
 // src/commands/doctor.ts
 import { existsSync as existsSync56, readFileSync as readFileSync47 } from "fs";
-import { join as join68, resolve as resolve20 } from "path";
+import { join as join69, resolve as resolve20 } from "path";
 import chalk21 from "chalk";
 import { Command as Command25 } from "commander";
 
@@ -16638,33 +16638,110 @@ async function reapAllBareBranches(cwd, branches, worktrees, currentBranch, deps
   return outcomes;
 }
 
-// src/commands/doctor.ts
+// src/lib/scratch-clone-scan.ts
+import { readdirSync as readdirSync29, statSync as statSync18 } from "fs";
+import { join as join68 } from "path";
 var INTEGRATION_BRANCH = "dev";
+function isPlainCloneDir(path) {
+  try {
+    return statSync18(join68(path, ".git")).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function repoNameFromRemoteUrl(url) {
+  const trimmed = url.trim();
+  if (trimmed === "") return null;
+  const match = /\/([^/]+?)(\.git)?\/?$/.exec(trimmed);
+  return match?.[1] && match[1] !== "" ? match[1] : null;
+}
+async function findScratchCloneCandidates(estateRoot, deps) {
+  const names = readdirSync29(estateRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  const candidates = [];
+  for (const name of names) {
+    const path = join68(estateRoot, name);
+    if (!isPlainCloneDir(path)) continue;
+    let branch;
+    try {
+      branch = await deps.git.currentBranch(path);
+    } catch {
+      candidates.push({ path, branch: "", invalidRepo: true });
+      continue;
+    }
+    const remoteUrl = await deps.git.getRemoteUrl(path).catch(() => "");
+    const repoName = remoteUrl === "" ? null : repoNameFromRemoteUrl(remoteUrl);
+    const looksLikeKnownRepoCheckout = repoName !== null && repoName.toLowerCase() === name.toLowerCase() && branch === INTEGRATION_BRANCH;
+    if (looksLikeKnownRepoCheckout) continue;
+    candidates.push({ path, branch });
+  }
+  return candidates;
+}
+async function classifyScratchClones(candidates, deps) {
+  const reports = [];
+  for (const candidate of candidates) {
+    if (candidate.invalidRepo === true) {
+      reports.push({ candidate, verdict: { action: "keep", reason: "not-a-git-repository" } });
+      continue;
+    }
+    const isDetached = candidate.branch === "HEAD" || candidate.branch === "";
+    const isDirty = await deps.git.hasUncommittedChanges(candidate.path);
+    const prVerdict = isDetached || isDirty ? "unknown" : await deps.github.prVerdictForBranch(candidate.path, candidate.branch);
+    let mergeContainsHead = true;
+    if (prVerdict === "merged") {
+      const [headSha, mergedHeadSha] = await Promise.all([
+        deps.git.headSha(candidate.path),
+        deps.github.mergedHeadSha(candidate.path, candidate.branch)
+      ]);
+      mergeContainsHead = headSha === null || mergedHeadSha === null ? null : await deps.git.isAncestor(candidate.path, headSha, mergedHeadSha);
+    }
+    const verdict = classifyReapCandidate({
+      isDetached,
+      isDirty,
+      hasFleetClaim: false,
+      prVerdict,
+      mergeContainsHead
+    });
+    reports.push({ candidate, verdict });
+  }
+  return reports;
+}
+
+// src/commands/doctor.ts
+var INTEGRATION_BRANCH2 = "dev";
 var doctorCommand = new Command25("doctor").description(
   "Report repo-state conditions that make everything read from this checkout unreliable"
 ).option("--cwd <path>", "Repo root to inspect (defaults to the current directory)").option("--no-fetch", "Skip the fetch; report against refs as they already are locally").option(
   "--fix",
   "Also remove any worktree, and delete any bare local branch, PROVEN safe: one whose branch's PR merged, verified via GitHub (never local commit reachability \u2014 a squash merge rewrites every SHA), AND whose current tip is confirmed contained in what that PR actually shipped \u2014 not merely on a branch of the same name (#1810). Everything else (no PR, PR open, PR closed unmerged, detached HEAD, uncommitted changes, commits ahead of what merged, or that containment could not be confirmed) is reported, never touched."
-).action(async (options) => {
-  const cwd = options.cwd ? resolve20(options.cwd) : process.cwd();
-  const git = new GitAdapter();
-  try {
-    const facts = await gatherRepoFacts({ cwd, fetch: options.fetch !== false }, { git });
-    const findings = runDoctorChecks(facts);
-    printFindings(findings);
-    if (options.fix === true) {
-      const github = new GithubCliAdapter();
-      const outcomes = await runDoctorFix(cwd, facts, { git, github });
-      printReapOutcomes(outcomes);
-      const branchOutcomes = await runDoctorFixBranches(cwd, facts, { git, github });
-      printBranchReapOutcomes(branchOutcomes);
-    }
-    if (findings.some((f) => f.severity === "error")) process.exit(1);
-  } catch (err) {
-    log.error(err.message);
-    process.exit(1);
+).option(
+  "--scratch-clones <estateRoot>",
+  "Instead of checking one repo, scan <estateRoot> for top-level plain `git clone` directories (#1949) \u2014 invisible to every check above, which all start from `git worktree list`. Each is classified the same way `--fix` classifies a worktree (GitHub's own PR verdict), but nothing is ever removed by this mode: a wrongly-excluded directory costs a report line, an `rm -rf` on a wrongly-included one would not be recoverable the way `git worktree remove` is."
+).action(
+  async (options) => {
+    if (options.scratchClones !== void 0) {
+      await runScratchCloneScan(resolve20(options.scratchClones));
+      return;
+    }
+    const cwd = options.cwd ? resolve20(options.cwd) : process.cwd();
+    const git = new GitAdapter();
+    try {
+      const facts = await gatherRepoFacts({ cwd, fetch: options.fetch !== false }, { git });
+      const findings = runDoctorChecks(facts);
+      printFindings(findings);
+      if (options.fix === true) {
+        const github = new GithubCliAdapter();
+        const outcomes = await runDoctorFix(cwd, facts, { git, github });
+        printReapOutcomes(outcomes);
+        const branchOutcomes = await runDoctorFixBranches(cwd, facts, { git, github });
+        printBranchReapOutcomes(branchOutcomes);
+      }
+      if (findings.some((f) => f.severity === "error")) process.exit(1);
+    } catch (err) {
+      log.error(err.message);
+      process.exit(1);
+    }
   }
-});
+);
 async function gatherRepoFacts(options, deps) {
   const { git } = deps;
   if (!await git.isGitRepo(options.cwd)) {
@@ -16680,13 +16757,13 @@ async function gatherRepoFacts(options, deps) {
   const worktrees = await Promise.all(
     worktreePaths.map(async (w) => ({
       ...w,
-      behind: await git.countBehind(options.cwd, w.branch, `origin/${INTEGRATION_BRANCH}`)
+      behind: await git.countBehind(options.cwd, w.branch, `origin/${INTEGRATION_BRANCH2}`)
     }))
   );
   return {
     currentBranch,
     isPrimary,
-    integrationBranch: INTEGRATION_BRANCH,
+    integrationBranch: INTEGRATION_BRANCH2,
     ahead,
     behind,
     hasUpstream,
@@ -16697,7 +16774,7 @@ async function gatherRepoFacts(options, deps) {
     // a fault in it.
     localCoreVersion: readLocalCoreVersion(options.cwd),
     remoteCoreVersion: parseCoreRecord(
-      await git.showFileAtRef(options.cwd, `origin/${INTEGRATION_BRANCH}`, INSTANCE_CORE_FILE)
+      await git.showFileAtRef(options.cwd, `origin/${INTEGRATION_BRANCH2}`, INSTANCE_CORE_FILE)
     ),
     fossilCoreVersion: readFossil(options.cwd),
     branches,
@@ -16719,8 +16796,50 @@ async function runDoctorFixBranches(cwd, facts, deps = { git: new GitAdapter(),
     remoteBranchNames
   );
 }
+async function runScratchCloneScan(estateRoot) {
+  const git = new GitAdapter();
+  const github = new GithubCliAdapter();
+  try {
+    const candidates = await findScratchCloneCandidates(estateRoot, { git });
+    const reports = await classifyScratchClones(candidates, { git, github });
+    printScratchCloneReports(estateRoot, reports);
+  } catch (err) {
+    log.error(err.message);
+    process.exit(1);
+  }
+}
+function printScratchCloneReports(estateRoot, reports) {
+  if (reports.length === 0) {
+    console.log(
+      chalk21.dim(`  scratch-clones: no plain git-clone directory found under ${estateRoot}.
+`)
+    );
+    return;
+  }
+  const reapable = reports.filter((r) => r.verdict.action === "reap");
+  const kept = reports.filter((r) => r.verdict.action === "keep");
+  console.log("");
+  for (const r of reapable) {
+    console.log(
+      chalk21.yellow(
+        `  reapable  ${r.candidate.path} (${r.candidate.branch}) \u2014 branch's PR merged and this clone's tip is contained in what shipped; plain git clone, not a worktree, so \`git worktree remove\` does not apply \u2014 remove by hand once confirmed: rm -rf '${r.candidate.path}'`
+      )
+    );
+  }
+  for (const r of kept) {
+    const reason = r.verdict.reason === void 0 ? "unknown" : KEEP_REASON_TEXT[r.verdict.reason];
+    console.log(chalk21.dim(`  kept      ${r.candidate.path} (${r.candidate.branch}) \u2014 ${reason}`));
+  }
+  console.log(
+    chalk21.dim(
+      `
+  scratch-clones: ${String(reapable.length)} reapable, ${String(kept.length)} kept, of ${String(reports.length)} plain git-clone director${reports.length === 1 ? "y" : "ies"} found under ${estateRoot}.
+`
+    )
+  );
+}
 function readLocalCoreVersion(cwd) {
-  const path = join68(cwd, INSTANCE_CORE_FILE);
+  const path = join69(cwd, INSTANCE_CORE_FILE);
   if (!existsSync56(path)) return null;
   try {
     return extractVersionField(readFileSync47(path, "utf8"));
@@ -16743,7 +16862,7 @@ function extractVersionField(contents) {
   return match?.[1] ?? null;
 }
 function readFossil(cwd) {
-  const path = join68(cwd, CORE_VERSION_FILE);
+  const path = join69(cwd, CORE_VERSION_FILE);
   if (!existsSync56(path)) return null;
   try {
     const value = readFileSync47(path, "utf8").trim();
@@ -16783,7 +16902,8 @@ var KEEP_REASON_TEXT = {
   "no-pr": "no PR was ever opened from this branch",
   "unknown-pr-verdict": "could not read this branch's PR state from GitHub",
   "commits-not-in-merge": "worktree HEAD includes commits the merged PR never shipped",
-  "unknown-merge-head": "could not confirm worktree HEAD is contained in what merged"
+  "unknown-merge-head": "could not confirm worktree HEAD is contained in what merged",
+  "not-a-git-repository": "the .git directory exists but is not a resolvable, initialised git repository"
 };
 function printReapOutcomes(outcomes) {
   if (outcomes.length === 0) {
@@ -17277,18 +17397,18 @@ function resolveGithubToken4() {
 
 // src/lib/packaged-script-command.ts
 import { spawnSync } from "child_process";
-import { chmodSync as chmodSync2, statSync as statSync18 } from "fs";
+import { chmodSync as chmodSync2, statSync as statSync19 } from "fs";
 import { dirname as dirname12 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command27 } from "commander";
 
 // src/lib/packaged-scripts.ts
 import { existsSync as existsSync57 } from "fs";
-import { dirname as dirname11, join as join69 } from "path";
+import { dirname as dirname11, join as join70 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join69(dir, relativePath);
+    const candidate = join70(dir, relativePath);
     if (existsSync57(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;
@@ -17303,7 +17423,7 @@ It ships with this package via cli/scripts/packaged-root-assets.mjs; if you are
 // src/lib/packaged-script-command.ts
 function ensureExecutable(script) {
   try {
-    const { mode } = statSync18(script);
+    const { mode } = statSync19(script);
     if ((mode & 73) === 0) chmodSync2(script, mode | 493);
   } catch {
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.312.4",
+  "version": "0.313.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",

package/scripts/verify.sh

@@ -1273,6 +1273,10 @@ elif [ -z "$PG_TEST_DSN" ]; then
       printf '  the pg-test lane above did not run. CI treats it as a required check, so a\n'
       printf '  push here would report green without having checked the thing most likely\n'
       printf '  to need it.\n\n'
+      printf '  This is NOT a credentials or network problem. It is a local gate refusing\n'
+      printf '  to push until the Postgres test lane runs. If git prints its own generic\n'
+      printf '  "failed to push some refs" line below this, that is git relaying THIS exit\n'
+      printf '  code -- not a rejection by GitHub or a sign of a bad token.\n\n'
       printf '  Get a DSN and re-run:\n'
       printf '    eval "$(sh scripts/pg-test-db.sh --export)"   # if this repo ships one\n'
       printf '    export BIFFO_TEST_PG_DSN=postgresql+asyncpg://user:pass@host:port/db\n\n'