@biffo/cli 0.315.2 → 0.315.4

package/_skeletons/plugin-template/scripts/py-dependency-audit-truncation.test.sh

@@ -0,0 +1,272 @@
+#!/usr/bin/env sh
+#
+# Proves py-dependency-audit.sh (#1995) no longer pipes a large writer
+# directly into `head -c N`. `head -c` closes its read end the instant it
+# has enough bytes; if the upstream write is still in flight when that
+# happens, the writer gets SIGPIPE. Confirmed live via `strace -f` against
+# the real script's line-234 command (a >4000-byte jq-filtered finding
+# dump): `jq`, forked from that exact pipeline, was silently killed by
+# SIGPIPE the instant `head -c 4000` closed early on a large payload. That
+# is the general mechanism #1995 reports. The CI-only "printf: printf: I/O
+# error" wording it also reports needs dash's own builtin `printf` to be the
+# process still writing at that instant -- a narrower timing window this
+# workstation's dash/kernel did not reproduce across repeated attempts up to
+# a 94MB payload (see the PR body for the full trail). The issue's own
+# citation -- a real, timestamped CI job log
+# (biffo-plugin-idea-scout PR #126) -- is the evidence for that exact
+# wording; this file does not re-derive it.
+#
+# That same "I/O error" shape hit Case 1's own negative control for real, in
+# guard-self-test-wiring.sh's CI run (34391849474, job 102607880682, head
+# eeabce12): the runner's dash does not die to SIGPIPE the way this
+# workstation's does -- its printf builtin catches the broken pipe, reports
+# "printf: printf: I/O error" to stderr, returns a nonzero status, and lets
+# the subshell keep running past it. Case 1's check used to recognise only
+# the SIGPIPE-death shape (marker file absent) and treated any marker
+# present as "the defect didn't reproduce" -- so on that runner it failed
+# for the same reason the fix exists: an outcome the control's own author
+# had not seen. The fix is to the control's DETECTION, not the mechanism
+# under test: it accepts either manifestation of the same defect (killed
+# outright, or survived with a reported failure) as reproduced.
+#
+# ## Case 1: deterministic proof of the pipe-shape defect and its fix
+#
+# Removes scheduling luck from the underlying mechanism instead of racing
+# for it: the writer sleeps briefly before writing, so a reader that exits
+# immediately is GUARANTEED to have already closed its read end before the
+# writer's first write() call. Shows the OLD shape (writer piped straight
+# into a reader that may close early) never gets through cleanly -- either
+# the writer is killed before it can report anything, or it survives but its
+# own write reports the broken pipe as a failure -- and the NEW shape this
+# fix uses (write to a regular file first, read the FINISHED file) never
+# does either, regardless of payload size or timing -- because there is no
+# concurrent writer left for a reader to break.
+#
+# ## Case 2: the real script, end to end, with a >4000-byte finding
+#
+# Reuses the uv-stub harness from py-dependency-audit-classification.test.sh
+# to run the actual target script against a finding payload whose filtered
+# JSON exceeds the 4000-byte truncation threshold, and checks the
+# classification/exit-code behaviour and the truncated dump are unaffected
+# by the fix.
+#
+# Run: sh scripts/py-dependency-audit-truncation.test.sh
+
+set -u
+
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+TARGET="$SCRIPT_DIR/py-dependency-audit.sh"
+
+WORK_DIR=$(mktemp -d)
+trap 'rm -rf "$WORK_DIR"' EXIT
+
+FAILURES=0
+
+# ============================================================================
+# Case 0: the target script actually uses the safe shape
+# ============================================================================
+#
+# Case 1 below proves the OLD shape is unsafe and the NEW shape is not, as a
+# standalone fact about pipes -- it does not read $TARGET, so on its own it
+# would not notice a regression that reverted the real script back to the
+# vulnerable pattern. This case closes that gap directly against the file.
+
+if grep -Eq "jq '\[\.dependencies\[\] \| select\(\.vulns \| length > 0\)\]' 2>/dev/null \| head -c" "$TARGET"; then
+  echo "FAIL: $TARGET pipes the vulns dump straight from jq into head -c again -- this is the exact shape #1995 reports"
+  FAILURES=$((FAILURES + 1))
+else
+  echo "PASS: $TARGET does not pipe the vulns dump straight from jq into head -c"
+fi
+
+if grep -q 'head -c 4000 "\$dump_file"' "$TARGET"; then
+  echo "PASS: $TARGET truncates from a finished regular file, not a live pipe"
+else
+  echo "FAIL: $TARGET no longer truncates from a regular file -- expected a 'head -c 4000 \"\$dump_file\"' line"
+  FAILURES=$((FAILURES + 1))
+fi
+
+# ============================================================================
+# Case 1: deterministic pipe-shape proof
+# ============================================================================
+
+# 2MB of 'a' -- comfortably over the 64KiB Linux pipe buffer, so a writer
+# emitting it in one shot cannot fit in the buffer and must block on a
+# reader that may already be gone.
+PAYLOAD="$(head -c 2000000 /dev/zero | tr '\0' 'a')"
+
+# OLD shape: writer piped straight into an early-closing reader (`{ : ; }`
+# reads nothing and exits immediately). The `sleep 0.5` guarantees the
+# reader has already exited and closed its read end before the writer's
+# first write() call -- this is not racing the scheduler, it is removing
+# the race.
+#
+# The manifestation of "the writer did not survive" is NOT uniform across
+# dash builds. On this workstation, the write gets SIGPIPE and the whole
+# subshell dies mid-write, so it never reaches the `printf_rc` capture below
+# and the marker file is simply absent -- that used to be the only shape
+# this case checked for. But the CI runner's dash does NOT die to the
+# signal: its printf builtin catches the broken pipe itself, prints
+# "printf: printf: I/O error" to stderr, returns a NONZERO exit status, and
+# the subshell keeps running past it -- there is no `&&`/`set -e` between
+# these statements -- so the marker gets written anyway. Confirmed verbatim
+# in run 34391849474 job 102607880682: line 91 (this line) is exactly where
+# "I/O error" was reported, and the case still failed with "unexpectedly let
+# the writer complete", because the old check only recognised the
+# SIGPIPE-death shape and treated ANY marker as proof the writer silently
+# succeeded -- including one written after printf itself had just reported
+# failure.
+#
+# So the marker now carries printf's own exit status instead of a fixed
+# "wrote", and either manifestation of the same underlying defect counts as
+# reproduced: the writer is killed outright (marker absent), or it survives
+# but printf reports the broken pipe as a failure (marker present with a
+# nonzero code, or stderr non-empty). Only a marker present with an
+# unqualified rc=0 and empty stderr -- meaning the write to an
+# already-closed reader somehow succeeded without a trace -- fails to
+# reproduce the defect this case exists to demonstrate.
+old_marker="$WORK_DIR/old_marker"
+old_stderr="$WORK_DIR/old_stderr"
+(
+  sleep 0.5
+  printf '%s' "$PAYLOAD"
+  printf_rc=$?
+  echo "$printf_rc" > "$old_marker"
+) | { : ; } 2>"$old_stderr"
+
+old_rc=""
+if [ -s "$old_marker" ]; then
+  old_rc=$(cat "$old_marker")
+fi
+
+if [ ! -s "$old_marker" ]; then
+  echo "PASS: old pipe shape (writer | early-closing reader) kills the writer before it can report anything -- the defect #1995 reports, reproduced deterministically (writer terminated outright, e.g. by SIGPIPE)"
+elif [ "$old_rc" != "0" ] || [ -s "$old_stderr" ]; then
+  echo "PASS: old pipe shape (writer | early-closing reader) lets the writer survive but its own write reports the broken pipe as a failure -- the defect #1995 reports, reproduced deterministically (printf exit=$old_rc, stderr: $(tr '\n' ' ' < "$old_stderr"))"
+else
+  echo "FAIL: old pipe shape unexpectedly let the writer complete with no error of any kind -- the defect this case exists to demonstrate did not reproduce"
+  FAILURES=$((FAILURES + 1))
+fi
+
+# NEW shape: writer completes into a regular file first; the "reader" then
+# reads the FINISHED file, with no concurrent writer left to break. Must
+# always succeed, regardless of payload size or timing.
+new_dump="$WORK_DIR/new_dump"
+printf '%s' "$PAYLOAD" > "$new_dump"
+new_write_rc=$?
+: < "$new_dump"
+new_read_rc=$?
+
+if [ "$new_write_rc" -eq 0 ] && [ "$new_read_rc" -eq 0 ]; then
+  echo "PASS: new shape (write to a file, then read the finished file) always succeeds -- no live pipe for a reader to close early"
+else
+  echo "FAIL: new shape unexpectedly failed (write rc=$new_write_rc, read rc=$new_read_rc)"
+  FAILURES=$((FAILURES + 1))
+fi
+
+# ============================================================================
+# Case 2: the real script, end to end, against a >4000-byte finding
+# ============================================================================
+
+STUB_DIR="$WORK_DIR/stub"
+REPO_DIR="$WORK_DIR/repo"
+OUT_FILE="$WORK_DIR/out"
+mkdir -p "$STUB_DIR" "$REPO_DIR"
+
+cat > "$STUB_DIR/uv" <<'STUB'
+#!/usr/bin/env sh
+if [ "$1" = "run" ] && [ "$2" = "pip-audit" ]; then
+  cat "$PIPAUDIT_STUB_OUTPUT"
+  exit 0
+fi
+echo "uv stub: unexpected invocation: $*" >&2
+exit 99
+STUB
+chmod +x "$STUB_DIR/uv"
+
+( cd "$REPO_DIR" \
+  && git init -q -b trunk \
+  && git config user.email test@example.com \
+  && git config user.name "Test" )
+cat > "$REPO_DIR/uv.lock" <<'LOCK'
+version = 1
+requires-python = ">=3.13"
+
+[[package]]
+name = "pip"
+version = "26.1.2"
+source = { registry = "https://pypi.org/simple" }
+LOCK
+( cd "$REPO_DIR" && git add -A && git commit -q -m base )
+( cd "$REPO_DIR" && git branch -q "origin/dev" )
+
+# A single package carrying enough vulns that jq's filtered dump of it
+# exceeds 4000 bytes -- the exact condition #1995 requires (small payloads
+# never hit the truncation path at all).
+{
+  printf '{"dependencies": [{"name": "pip", "version": "26.1.2", "vulns": ['
+  i=0
+  while [ "$i" -lt 60 ]; do
+    [ "$i" -gt 0 ] && printf ','
+    printf '{"id": "PYSEC-2026-%d", "fix_versions": ["26.2.1"], "description": "%s"}' \
+      "$i" "$(head -c 200 /dev/zero | tr '\0' 'x')"
+    i=$((i + 1))
+  done
+  printf ']}]}'
+} > "$STUB_DIR/pip-audit-output.json"
+
+filtered_size=$(cd "$REPO_DIR" && PATH="$STUB_DIR:$PATH" jq -c '[.dependencies[] | select(.vulns | length > 0)]' "$STUB_DIR/pip-audit-output.json" | wc -c | tr -d ' ')
+if [ "$filtered_size" -le 4000 ]; then
+  echo "FAIL: test fixture's filtered JSON is only ${filtered_size} bytes -- must exceed 4000 to exercise the truncation path #1995 is about"
+  FAILURES=$((FAILURES + 1))
+fi
+
+(
+  cd "$REPO_DIR" || exit 97
+  PATH="$STUB_DIR:$PATH"
+  export PATH
+  PIPAUDIT_STUB_OUTPUT="$STUB_DIR/pip-audit-output.json"
+  export PIPAUDIT_STUB_OUTPUT
+  GITHUB_BASE_REF="dev"
+  export GITHUB_BASE_REF
+  sh "$TARGET"
+) >"$OUT_FILE" 2>&1
+rc=$?
+
+# pip@26.1.2 is unchanged between base and PR-head (#1673 classification),
+# so this must NOT block, same as case 1 in
+# py-dependency-audit-classification.test.sh.
+if [ "$rc" -eq 0 ]; then
+  echo "PASS: real script exits 0 on a >4000-byte pre-existing finding"
+else
+  echo "FAIL: real script exited ${rc}, expected 0 -- output:"
+  cat "$OUT_FILE"
+  FAILURES=$((FAILURES + 1))
+fi
+
+if grep -qF "pre-existing" "$OUT_FILE"; then
+  echo "PASS: real script still classifies the finding as pre-existing"
+else
+  echo "FAIL: real script's output does not mention 'pre-existing' -- output:"
+  cat "$OUT_FILE"
+  FAILURES=$((FAILURES + 1))
+fi
+
+out_size=$(wc -c < "$OUT_FILE" | tr -d ' ')
+# The whole run's combined output, not just the dump, so this is a loose
+# ceiling -- it exists to catch a regression that stops truncating at all
+# (e.g. the dump ever growing back to the full ~13KB filtered JSON).
+if [ "$out_size" -lt 8000 ]; then
+  echo "PASS: real script's combined output (${out_size} bytes) stays bounded -- the dump is still truncated"
+else
+  echo "FAIL: real script's combined output is ${out_size} bytes -- the truncation may no longer be applied"
+  FAILURES=$((FAILURES + 1))
+fi
+
+echo
+if [ "$FAILURES" -eq 0 ]; then
+  echo "py-dependency-audit-truncation.test.sh: all checks passed."
+  exit 0
+else
+  echo "py-dependency-audit-truncation.test.sh: $FAILURES check(s) failed."
+  exit 1
+fi

package/_skeletons/plugin-template/scripts/py-dependency-audit.sh

@@ -231,7 +231,20 @@ audit_deps() {
         done < "$findings_file"
         rm -f "$findings_file"
 
-        printf '%s' "$out" | jq '[.dependencies[] | select(.vulns | length > 0)]' 2>/dev/null | head -c 4000
+        # Written to a regular file first, then truncated with `head -c` from
+        # that file rather than from a live pipe -- the same reason
+        # `findings_file` above does it. `head -c 4000` piped directly onto
+        # `jq`'s output closes its read end the instant it has enough bytes;
+        # if the filtered JSON exceeds 4000 bytes, jq (and on a big enough
+        # payload, the upstream `printf` still writing into jq's now-closed
+        # stdin) can get SIGPIPE and dash's builtin `printf` reports that as a
+        # stray "printf: I/O error" line into an otherwise-clean, passing log
+        # (#1995). Reading a finished, regular file has no concurrent writer
+        # to break, so there is no pipe left for `head` to close early on.
+        dump_file="$(mktemp)"
+        printf '%s' "$out" | jq '[.dependencies[] | select(.vulns | length > 0)]' 2>/dev/null > "$dump_file"
+        head -c 4000 "$dump_file"
+        rm -f "$dump_file"
 
         if [ "$introduced_count" -gt 0 ]; then
           echo "::error::${label}: ${introduced_count} vulnerability(ies) introduced or upgraded by this diff (${preexisting_count} more pre-existing, not counted against it)."

package/_skeletons/sibling-template/scripts/py-dependency-audit-truncation.test.sh

@@ -0,0 +1,272 @@
+#!/usr/bin/env sh
+#
+# Proves py-dependency-audit.sh (#1995) no longer pipes a large writer
+# directly into `head -c N`. `head -c` closes its read end the instant it
+# has enough bytes; if the upstream write is still in flight when that
+# happens, the writer gets SIGPIPE. Confirmed live via `strace -f` against
+# the real script's line-234 command (a >4000-byte jq-filtered finding
+# dump): `jq`, forked from that exact pipeline, was silently killed by
+# SIGPIPE the instant `head -c 4000` closed early on a large payload. That
+# is the general mechanism #1995 reports. The CI-only "printf: printf: I/O
+# error" wording it also reports needs dash's own builtin `printf` to be the
+# process still writing at that instant -- a narrower timing window this
+# workstation's dash/kernel did not reproduce across repeated attempts up to
+# a 94MB payload (see the PR body for the full trail). The issue's own
+# citation -- a real, timestamped CI job log
+# (biffo-plugin-idea-scout PR #126) -- is the evidence for that exact
+# wording; this file does not re-derive it.
+#
+# That same "I/O error" shape hit Case 1's own negative control for real, in
+# guard-self-test-wiring.sh's CI run (34391849474, job 102607880682, head
+# eeabce12): the runner's dash does not die to SIGPIPE the way this
+# workstation's does -- its printf builtin catches the broken pipe, reports
+# "printf: printf: I/O error" to stderr, returns a nonzero status, and lets
+# the subshell keep running past it. Case 1's check used to recognise only
+# the SIGPIPE-death shape (marker file absent) and treated any marker
+# present as "the defect didn't reproduce" -- so on that runner it failed
+# for the same reason the fix exists: an outcome the control's own author
+# had not seen. The fix is to the control's DETECTION, not the mechanism
+# under test: it accepts either manifestation of the same defect (killed
+# outright, or survived with a reported failure) as reproduced.
+#
+# ## Case 1: deterministic proof of the pipe-shape defect and its fix
+#
+# Removes scheduling luck from the underlying mechanism instead of racing
+# for it: the writer sleeps briefly before writing, so a reader that exits
+# immediately is GUARANTEED to have already closed its read end before the
+# writer's first write() call. Shows the OLD shape (writer piped straight
+# into a reader that may close early) never gets through cleanly -- either
+# the writer is killed before it can report anything, or it survives but its
+# own write reports the broken pipe as a failure -- and the NEW shape this
+# fix uses (write to a regular file first, read the FINISHED file) never
+# does either, regardless of payload size or timing -- because there is no
+# concurrent writer left for a reader to break.
+#
+# ## Case 2: the real script, end to end, with a >4000-byte finding
+#
+# Reuses the uv-stub harness from py-dependency-audit-classification.test.sh
+# to run the actual target script against a finding payload whose filtered
+# JSON exceeds the 4000-byte truncation threshold, and checks the
+# classification/exit-code behaviour and the truncated dump are unaffected
+# by the fix.
+#
+# Run: sh scripts/py-dependency-audit-truncation.test.sh
+
+set -u
+
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+TARGET="$SCRIPT_DIR/py-dependency-audit.sh"
+
+WORK_DIR=$(mktemp -d)
+trap 'rm -rf "$WORK_DIR"' EXIT
+
+FAILURES=0
+
+# ============================================================================
+# Case 0: the target script actually uses the safe shape
+# ============================================================================
+#
+# Case 1 below proves the OLD shape is unsafe and the NEW shape is not, as a
+# standalone fact about pipes -- it does not read $TARGET, so on its own it
+# would not notice a regression that reverted the real script back to the
+# vulnerable pattern. This case closes that gap directly against the file.
+
+if grep -Eq "jq '\[\.dependencies\[\] \| select\(\.vulns \| length > 0\)\]' 2>/dev/null \| head -c" "$TARGET"; then
+  echo "FAIL: $TARGET pipes the vulns dump straight from jq into head -c again -- this is the exact shape #1995 reports"
+  FAILURES=$((FAILURES + 1))
+else
+  echo "PASS: $TARGET does not pipe the vulns dump straight from jq into head -c"
+fi
+
+if grep -q 'head -c 4000 "\$dump_file"' "$TARGET"; then
+  echo "PASS: $TARGET truncates from a finished regular file, not a live pipe"
+else
+  echo "FAIL: $TARGET no longer truncates from a regular file -- expected a 'head -c 4000 \"\$dump_file\"' line"
+  FAILURES=$((FAILURES + 1))
+fi
+
+# ============================================================================
+# Case 1: deterministic pipe-shape proof
+# ============================================================================
+
+# 2MB of 'a' -- comfortably over the 64KiB Linux pipe buffer, so a writer
+# emitting it in one shot cannot fit in the buffer and must block on a
+# reader that may already be gone.
+PAYLOAD="$(head -c 2000000 /dev/zero | tr '\0' 'a')"
+
+# OLD shape: writer piped straight into an early-closing reader (`{ : ; }`
+# reads nothing and exits immediately). The `sleep 0.5` guarantees the
+# reader has already exited and closed its read end before the writer's
+# first write() call -- this is not racing the scheduler, it is removing
+# the race.
+#
+# The manifestation of "the writer did not survive" is NOT uniform across
+# dash builds. On this workstation, the write gets SIGPIPE and the whole
+# subshell dies mid-write, so it never reaches the `printf_rc` capture below
+# and the marker file is simply absent -- that used to be the only shape
+# this case checked for. But the CI runner's dash does NOT die to the
+# signal: its printf builtin catches the broken pipe itself, prints
+# "printf: printf: I/O error" to stderr, returns a NONZERO exit status, and
+# the subshell keeps running past it -- there is no `&&`/`set -e` between
+# these statements -- so the marker gets written anyway. Confirmed verbatim
+# in run 34391849474 job 102607880682: line 91 (this line) is exactly where
+# "I/O error" was reported, and the case still failed with "unexpectedly let
+# the writer complete", because the old check only recognised the
+# SIGPIPE-death shape and treated ANY marker as proof the writer silently
+# succeeded -- including one written after printf itself had just reported
+# failure.
+#
+# So the marker now carries printf's own exit status instead of a fixed
+# "wrote", and either manifestation of the same underlying defect counts as
+# reproduced: the writer is killed outright (marker absent), or it survives
+# but printf reports the broken pipe as a failure (marker present with a
+# nonzero code, or stderr non-empty). Only a marker present with an
+# unqualified rc=0 and empty stderr -- meaning the write to an
+# already-closed reader somehow succeeded without a trace -- fails to
+# reproduce the defect this case exists to demonstrate.
+old_marker="$WORK_DIR/old_marker"
+old_stderr="$WORK_DIR/old_stderr"
+(
+  sleep 0.5
+  printf '%s' "$PAYLOAD"
+  printf_rc=$?
+  echo "$printf_rc" > "$old_marker"
+) | { : ; } 2>"$old_stderr"
+
+old_rc=""
+if [ -s "$old_marker" ]; then
+  old_rc=$(cat "$old_marker")
+fi
+
+if [ ! -s "$old_marker" ]; then
+  echo "PASS: old pipe shape (writer | early-closing reader) kills the writer before it can report anything -- the defect #1995 reports, reproduced deterministically (writer terminated outright, e.g. by SIGPIPE)"
+elif [ "$old_rc" != "0" ] || [ -s "$old_stderr" ]; then
+  echo "PASS: old pipe shape (writer | early-closing reader) lets the writer survive but its own write reports the broken pipe as a failure -- the defect #1995 reports, reproduced deterministically (printf exit=$old_rc, stderr: $(tr '\n' ' ' < "$old_stderr"))"
+else
+  echo "FAIL: old pipe shape unexpectedly let the writer complete with no error of any kind -- the defect this case exists to demonstrate did not reproduce"
+  FAILURES=$((FAILURES + 1))
+fi
+
+# NEW shape: writer completes into a regular file first; the "reader" then
+# reads the FINISHED file, with no concurrent writer left to break. Must
+# always succeed, regardless of payload size or timing.
+new_dump="$WORK_DIR/new_dump"
+printf '%s' "$PAYLOAD" > "$new_dump"
+new_write_rc=$?
+: < "$new_dump"
+new_read_rc=$?
+
+if [ "$new_write_rc" -eq 0 ] && [ "$new_read_rc" -eq 0 ]; then
+  echo "PASS: new shape (write to a file, then read the finished file) always succeeds -- no live pipe for a reader to close early"
+else
+  echo "FAIL: new shape unexpectedly failed (write rc=$new_write_rc, read rc=$new_read_rc)"
+  FAILURES=$((FAILURES + 1))
+fi
+
+# ============================================================================
+# Case 2: the real script, end to end, against a >4000-byte finding
+# ============================================================================
+
+STUB_DIR="$WORK_DIR/stub"
+REPO_DIR="$WORK_DIR/repo"
+OUT_FILE="$WORK_DIR/out"
+mkdir -p "$STUB_DIR" "$REPO_DIR"
+
+cat > "$STUB_DIR/uv" <<'STUB'
+#!/usr/bin/env sh
+if [ "$1" = "run" ] && [ "$2" = "pip-audit" ]; then
+  cat "$PIPAUDIT_STUB_OUTPUT"
+  exit 0
+fi
+echo "uv stub: unexpected invocation: $*" >&2
+exit 99
+STUB
+chmod +x "$STUB_DIR/uv"
+
+( cd "$REPO_DIR" \
+  && git init -q -b trunk \
+  && git config user.email test@example.com \
+  && git config user.name "Test" )
+cat > "$REPO_DIR/uv.lock" <<'LOCK'
+version = 1
+requires-python = ">=3.13"
+
+[[package]]
+name = "pip"
+version = "26.1.2"
+source = { registry = "https://pypi.org/simple" }
+LOCK
+( cd "$REPO_DIR" && git add -A && git commit -q -m base )
+( cd "$REPO_DIR" && git branch -q "origin/dev" )
+
+# A single package carrying enough vulns that jq's filtered dump of it
+# exceeds 4000 bytes -- the exact condition #1995 requires (small payloads
+# never hit the truncation path at all).
+{
+  printf '{"dependencies": [{"name": "pip", "version": "26.1.2", "vulns": ['
+  i=0
+  while [ "$i" -lt 60 ]; do
+    [ "$i" -gt 0 ] && printf ','
+    printf '{"id": "PYSEC-2026-%d", "fix_versions": ["26.2.1"], "description": "%s"}' \
+      "$i" "$(head -c 200 /dev/zero | tr '\0' 'x')"
+    i=$((i + 1))
+  done
+  printf ']}]}'
+} > "$STUB_DIR/pip-audit-output.json"
+
+filtered_size=$(cd "$REPO_DIR" && PATH="$STUB_DIR:$PATH" jq -c '[.dependencies[] | select(.vulns | length > 0)]' "$STUB_DIR/pip-audit-output.json" | wc -c | tr -d ' ')
+if [ "$filtered_size" -le 4000 ]; then
+  echo "FAIL: test fixture's filtered JSON is only ${filtered_size} bytes -- must exceed 4000 to exercise the truncation path #1995 is about"
+  FAILURES=$((FAILURES + 1))
+fi
+
+(
+  cd "$REPO_DIR" || exit 97
+  PATH="$STUB_DIR:$PATH"
+  export PATH
+  PIPAUDIT_STUB_OUTPUT="$STUB_DIR/pip-audit-output.json"
+  export PIPAUDIT_STUB_OUTPUT
+  GITHUB_BASE_REF="dev"
+  export GITHUB_BASE_REF
+  sh "$TARGET"
+) >"$OUT_FILE" 2>&1
+rc=$?
+
+# pip@26.1.2 is unchanged between base and PR-head (#1673 classification),
+# so this must NOT block, same as case 1 in
+# py-dependency-audit-classification.test.sh.
+if [ "$rc" -eq 0 ]; then
+  echo "PASS: real script exits 0 on a >4000-byte pre-existing finding"
+else
+  echo "FAIL: real script exited ${rc}, expected 0 -- output:"
+  cat "$OUT_FILE"
+  FAILURES=$((FAILURES + 1))
+fi
+
+if grep -qF "pre-existing" "$OUT_FILE"; then
+  echo "PASS: real script still classifies the finding as pre-existing"
+else
+  echo "FAIL: real script's output does not mention 'pre-existing' -- output:"
+  cat "$OUT_FILE"
+  FAILURES=$((FAILURES + 1))
+fi
+
+out_size=$(wc -c < "$OUT_FILE" | tr -d ' ')
+# The whole run's combined output, not just the dump, so this is a loose
+# ceiling -- it exists to catch a regression that stops truncating at all
+# (e.g. the dump ever growing back to the full ~13KB filtered JSON).
+if [ "$out_size" -lt 8000 ]; then
+  echo "PASS: real script's combined output (${out_size} bytes) stays bounded -- the dump is still truncated"
+else
+  echo "FAIL: real script's combined output is ${out_size} bytes -- the truncation may no longer be applied"
+  FAILURES=$((FAILURES + 1))
+fi
+
+echo
+if [ "$FAILURES" -eq 0 ]; then
+  echo "py-dependency-audit-truncation.test.sh: all checks passed."
+  exit 0
+else
+  echo "py-dependency-audit-truncation.test.sh: $FAILURES check(s) failed."
+  exit 1
+fi

package/_skeletons/sibling-template/scripts/py-dependency-audit.sh

@@ -231,7 +231,20 @@ audit_deps() {
         done < "$findings_file"
         rm -f "$findings_file"
 
-        printf '%s' "$out" | jq '[.dependencies[] | select(.vulns | length > 0)]' 2>/dev/null | head -c 4000
+        # Written to a regular file first, then truncated with `head -c` from
+        # that file rather than from a live pipe -- the same reason
+        # `findings_file` above does it. `head -c 4000` piped directly onto
+        # `jq`'s output closes its read end the instant it has enough bytes;
+        # if the filtered JSON exceeds 4000 bytes, jq (and on a big enough
+        # payload, the upstream `printf` still writing into jq's now-closed
+        # stdin) can get SIGPIPE and dash's builtin `printf` reports that as a
+        # stray "printf: I/O error" line into an otherwise-clean, passing log
+        # (#1995). Reading a finished, regular file has no concurrent writer
+        # to break, so there is no pipe left for `head` to close early on.
+        dump_file="$(mktemp)"
+        printf '%s' "$out" | jq '[.dependencies[] | select(.vulns | length > 0)]' 2>/dev/null > "$dump_file"
+        head -c 4000 "$dump_file"
+        rm -f "$dump_file"
 
         if [ "$introduced_count" -gt 0 ]; then
           echo "::error::${label}: ${introduced_count} vulnerability(ies) introduced or upgraded by this diff (${preexisting_count} more pre-existing, not counted against it)."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.315.2",
+  "version": "0.315.4",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",

package/scripts/pg-test-db.sh

@@ -35,8 +35,9 @@
 # `verify.sh` does: forks drift, and a per-instance copy of this would drift from
 # the DDL layout it is meant to build. Everything instance-specific is DERIVED --
 # the schema directories from `db/imports/*/`, the engine image from whether the
-# DDL asks for PostGIS, and the did-it-build threshold from the number of
-# policies the DDL itself declares. Nothing here names a product.
+# DDL asks for PostGIS, and the did-it-build check from what THIS repo's own
+# last known-good build actually produced (see #2023 below), never from a
+# guessed ratio. Nothing here names a product.
 #
 # ## Usage
 #
@@ -557,20 +558,63 @@ fingerprint() {
 
 WANT=$(fingerprint)
 HAVE=""
+HAVE_POLICIES=""
+HAVE_MODULES=""
 if [ "$RECREATE" -eq 0 ] &&
   psql_admin -tAc "SELECT 1 FROM pg_database WHERE datname='$DB'" 2>/dev/null | grep -q 1; then
   HAVE=$(psql -tAq -h "$HOST" -p "$PORT" -U "$USER_" -d "$DB" \
     -c "SELECT value FROM biffo_pg_test_fingerprint LIMIT 1" 2>/dev/null || true)
+  # policy_count/module_count were added alongside this guard (#2023). A row
+  # written before that migration has neither column, so this query fails
+  # (unknown column) rather than returning NULL, and `|| true` turns that
+  # failure into the same empty string a genuinely missing value would give --
+  # which is exactly what "unverifiable, so rebuild" needs below: it must read
+  # identically to "no stored count", never silently as "verified".
+  HAVE_POLICIES=$(psql -tAq -h "$HOST" -p "$PORT" -U "$USER_" -d "$DB" \
+    -c "SELECT policy_count FROM biffo_pg_test_fingerprint LIMIT 1" 2>/dev/null || true)
+  HAVE_MODULES=$(psql -tAq -h "$HOST" -p "$PORT" -U "$USER_" -d "$DB" \
+    -c "SELECT module_count FROM biffo_pg_test_fingerprint LIMIT 1" 2>/dev/null || true)
 fi
 
+# ── #2023: reuse must be verified against a known-good build, not a guess ────
+#
+# The old guard compared the live policy count to HALF of what the DDL
+# *declares* (`grep -c CREATE POLICY`) -- a number a correct, complete build
+# never reaches (521 declared vs. 362 produced on tabsii-platform, so the
+# healthy ratio is ~0.70, not 1.0). A database missing a quarter of its schema
+# passed it and was then blessed with a fingerprint every later run trusted.
+#
+# Worse, that check only ever ran on a fresh REBUILD (old section 4 below). The
+# reuse path here never re-verified anything beyond the content hash matching --
+# so a template that drifted after being blessed, by any means, was reused
+# forever with no check of its own at all.
+#
+# The fix compares against reality instead of a guess: on every successful
+# build (section 4), THIS script records the counts that build actually
+# produced. A fingerprint match only says the DDL inputs are unchanged; it says
+# nothing about whether the database in front of us still reflects what was
+# built from them. So reuse additionally requires the live counts to equal the
+# stored ones, exactly -- and a row with no stored counts (pre-#2023) is
+# unverifiable, not innocent, so it rebuilds rather than being trusted.
 if [ -n "$HAVE" ] && [ "$HAVE" = "$WANT" ]; then
-  say "schema is current, reusing $DB"
-  clone_for_this_run
-  emit
-  exit 0
+  if [ -z "$HAVE_POLICIES" ] || [ -z "$HAVE_MODULES" ]; then
+    say "fingerprint matches but this row predates stored policy/module counts - unverifiable, rebuilding rather than trusting it"
+  else
+    _live_policies=$(psql -tAq -h "$HOST" -p "$PORT" -U "$USER_" -d "$DB" \
+      -c "SELECT count(*) FROM pg_policies" 2>/dev/null || echo 0)
+    _live_modules=0
+    [ -n "$DDL_FILES" ] && _live_modules=$(echo "$DDL_FILES" | wc -l | tr -d ' ')
+    if [ "${_live_policies:-0}" = "$HAVE_POLICIES" ] && [ "$_live_modules" = "$HAVE_MODULES" ]; then
+      say "schema is current ($_live_policies policies, $_live_modules modules), reusing $DB"
+      clone_for_this_run
+      emit
+      exit 0
+    fi
+    say "fingerprint matches but live schema diverged from its own record (have $_live_policies policies/$_live_modules modules, recorded $HAVE_POLICIES/$HAVE_MODULES) - rebuilding rather than reusing a partial schema"
+  fi
 fi
 
-[ -n "$HAVE" ] && say "schema inputs changed - rebuilding rather than serving a stale schema"
+[ -n "$HAVE" ] && [ "$HAVE" != "$WANT" ] && say "schema inputs changed - rebuilding rather than serving a stale schema"
 
 # --- 3. rebuild the way the app and CI do ------------------------------------
 say "rebuilding $DB"
@@ -589,6 +633,7 @@ if [ -n "$ALEMBIC_DIR" ]; then
   say "alembic upgrade head"
 fi
 
+_module_count=0
 if [ -n "$DDL_FILES" ]; then
   # ONE psql session, sorted by filename, mirroring the API's own DDL import.
   # Session state an early module sets -- typically `SET search_path` in the
@@ -598,38 +643,37 @@ if [ -n "$DDL_FILES" ]; then
   # shellcheck disable=SC2046
   psql -q -v ON_ERROR_STOP=1 -h "$HOST" -p "$PORT" -U "$USER_" -d "$DB" \
     --single-transaction $(echo "$DDL_FILES" | sed 's/^/-f /' | tr '\n' ' ') >/dev/null
-  say "$(echo "$DDL_FILES" | wc -l | tr -d ' ') DDL modules applied"
+  _module_count=$(echo "$DDL_FILES" | wc -l | tr -d ' ')
+  say "$_module_count DDL modules applied"
 fi
 
-# --- 4. refuse to bless a half-built schema ----------------------------------
-#
-# The threshold is derived, not guessed: count the policies the DDL declares and
-# require the database to hold at least half. Recording a fingerprint against a
-# partial schema is worse than failing, because the NEXT run would trust it and
-# every failure after that would look like the developer's own change.
+# --- 4. record what this build actually produced (#2023) ---------------------
+#
+# No guessed threshold here anymore. The DDL apply above is one
+# `--single-transaction`, `ON_ERROR_STOP=1` psql session, so a build that fails
+# partway already aborts the whole script before reaching this line -- it does
+# not limp to here half-applied. What DOES reach here is simply recorded, and
+# it is that RECORD -- this build's own live counts, not a guess at what they
+# "should" be -- that the reuse guard above checks every later database
+# against. See the comment there for why a guessed ratio (521 declared, 362
+# produced) blessed a schema missing a quarter of itself.
+_policy_count=0
 if [ -n "$DDL_FILES" ]; then
-  _declared=$(echo "$DDL_FILES" | xargs grep -ciE '^[[:space:]]*CREATE[[:space:]]+POLICY' 2>/dev/null |
-    awk -F: '{s+=$NF} END {print s+0}')
-  if [ "${_declared:-0}" -gt 0 ]; then
-    _actual=$(psql -tAq -h "$HOST" -p "$PORT" -U "$USER_" -d "$DB" \
-      -c "SELECT count(*) FROM pg_policies" 2>/dev/null || echo 0)
-    if [ "${_actual:-0}" -lt $((_declared / 2)) ]; then
-      say "only ${_actual:-0} policies present against $_declared declared - the schema did not build."
-      say "Not recording a fingerprint; fix the DDL and re-run."
-      exit 1
-    fi
-    say "$_actual RLS policies ($_declared declared)"
-  fi
+  _policy_count=$(psql -tAq -h "$HOST" -p "$PORT" -U "$USER_" -d "$DB" \
+    -c "SELECT count(*) FROM pg_policies" 2>/dev/null || echo 0)
+  say "$_policy_count RLS policies, $_module_count DDL modules applied"
 fi
 
 psql_db \
   -c "CREATE TABLE IF NOT EXISTS biffo_pg_test_fingerprint (value text primary key)" \
+  -c "ALTER TABLE biffo_pg_test_fingerprint ADD COLUMN IF NOT EXISTS policy_count integer" \
+  -c "ALTER TABLE biffo_pg_test_fingerprint ADD COLUMN IF NOT EXISTS module_count integer" \
   -c "TRUNCATE biffo_pg_test_fingerprint" \
-  -c "INSERT INTO biffo_pg_test_fingerprint (value) VALUES ('$WANT')" >/dev/null
+  -c "INSERT INTO biffo_pg_test_fingerprint (value, policy_count, module_count) VALUES ('$WANT', $_policy_count, $_module_count)" >/dev/null
 
-# Only now, with the fingerprint recorded against a schema that passed the
-# check above, is the template fit to copy. Cloning earlier would hand out a
-# half-built database and record the failure against whoever ran next.
+# Only now, with the fingerprint and its counts recorded against a build that
+# actually completed, is the template fit to copy. Cloning earlier would hand
+# out a half-built database and record the failure against whoever ran next.
 clone_for_this_run
 
 say "ready"