@biffo/cli 0.315.7 → 0.315.8

package/_skeletons/plugin-template/scripts/js-dependency-audit-classification.test.sh

@@ -0,0 +1,304 @@
+#!/usr/bin/env sh
+#
+# Proves js-dependency-audit.sh (#2040) distinguishes "this PR's diff
+# introduced or upgraded to a vulnerable package version" from "an advisory
+# was published against a version already sitting on the base branch,
+# unrelated to this diff" -- rather than reporting an identical red for both.
+# This is the JS side of the fix py-dependency-audit.sh already got in
+# #1673; see that file's own classification test for the Python case table
+# this one mirrors.
+#
+# The real incident this guards against: two routine npm advisories
+# (GHSA-p293-qw3h-jr36 / Next.js, GHSA-82fw-gwwq-j7x9 / vitest) were
+# published against packages already on `dev` on 2026-09-08/09, with no code
+# change anywhere -- and turned the JS lane red on every open PR at once,
+# producing 89 fleet dispatches across 61 units in 8 repos and 10 duplicate
+# tickets for one classifier bug (#2040's own cost accounting). Case 1 below
+# reconstructs exactly that shape: base and PR both pinned at the flagged
+# version, PR diff untouched.
+#
+# ## Real `pnpm audit --json` shape, captured live
+#
+# Run against this repo's own workspace (pnpm 9.15.9, 2026-09-10):
+#
+#   $ pnpm audit --json
+#   {
+#     "advisories": {
+#       "1090893": {
+#         "severity": "low",
+#         "module_name": "cli",
+#         "github_advisory_id": "GHSA-6cpc-mj5c-m9rq",
+#         "findings": [{"version": "0.0.0", "paths": []}],
+#         ...
+#       }
+#     },
+#     "metadata": {
+#       "vulnerabilities": {"info": 0, "low": 1, "moderate": 0, "high": 0, "critical": 0},
+#       "totalDependencies": 929
+#     }
+#   }
+#
+# `.advisories` is an OBJECT keyed by an internal numeric id, not an array --
+# `.advisories[]?` iterates its values the same as an array would. Each
+# value carries `.severity`, `.module_name` and `.github_advisory_id`, which
+# is exactly what js-dependency-audit.sh's classification reads. The fixture
+# JSON below is shaped to match this real structure, not invented -- the
+# OLD version of js-dependency-audit-parallel.test.sh's stub JSON carried
+# only `.metadata.vulnerabilities` with no `.advisories` key at all, which
+# classification silently read as zero findings (fixed alongside this file;
+# see that test's own updated `_fail_json` comment).
+#
+# Also proves `pnpm audit` runs against a BARE lockfile copy with no install
+# and no workspace context -- verified directly, not assumed:
+#
+#   $ mkdir /tmp/probe && cp pnpm-lock.yaml /tmp/probe/ && cd /tmp/probe
+#   $ pnpm audit --json --ignore-workspace   # exits 0, real advisory output
+#
+# which is why the base-branch side of this comparison is a second real
+# `pnpm audit` call against a `git show`-extracted copy of the lockfile,
+# not a hand-rolled pnpm-lock.yaml parser.
+#
+# Builds a real, tiny, throwaway git repo under mktemp (never under /tmp as
+# a full worktree copy -- this is a from-scratch repo with a handful of
+# files, not a copy of this repository's own object store -- see AGENTS.md's
+# "never create a git worktree ... under /tmp", which this is not) with a
+# base branch and a PR-head state, and stubs `pnpm` on PATH so `pnpm audit
+# --json` returns a canned finding selected by a marker comment inside
+# whichever pnpm-lock.yaml the stub is invoked against -- no network, no
+# real registry. `jq`, `git` and `grep` are used for real -- they are
+# exactly what the target script itself depends on, so stubbing them would
+# test nothing.
+#
+# Run: sh scripts/js-dependency-audit-classification.test.sh
+
+set -u
+
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+TARGET="$SCRIPT_DIR/js-dependency-audit.sh"
+
+REPO_DIR=$(mktemp -d)
+STUB_DIR=$(mktemp -d)
+TMPROOT_DIR=$(mktemp -d)
+OUT_FILE=$(mktemp)
+trap 'rm -rf "$REPO_DIR" "$STUB_DIR" "$TMPROOT_DIR"; rm -f "$OUT_FILE"' EXIT
+
+FAILURES=0
+
+# --- pnpm stub ---------------------------------------------------------------
+# Selected by a `# STATE:<tag>` marker comment inside whatever
+# pnpm-lock.yaml is in the CURRENT DIRECTORY when invoked -- the target
+# script always `cd`s into the tree it is auditing (the repo's own working
+# tree for the HEAD run, or a scratch dir holding a `git show`-extracted
+# copy for the BASE run), so the marker travels with whichever commit's
+# content is actually being read, exactly like a real lockfile diff would.
+cat > "$STUB_DIR/pnpm" <<'STUB'
+#!/usr/bin/env sh
+if [ "$1" = "audit" ]; then
+  state=$(grep -o 'STATE:[A-Za-z0-9_-]*' pnpm-lock.yaml 2>/dev/null | head -1 | cut -d: -f2)
+  out_file="$STUB_DIR_ENV/output-${state:-clean}.json"
+  if [ -f "$out_file" ]; then
+    cat "$out_file"
+  else
+    cat "$STUB_DIR_ENV/output-clean.json"
+  fi
+  exit 0
+fi
+echo "pnpm stub: unexpected invocation: $*" >&2
+exit 99
+STUB
+chmod +x "$STUB_DIR/pnpm"
+
+# --- fixture JSON, one per STATE tag ----------------------------------------
+cat > "$STUB_DIR/output-clean.json" <<'JSON'
+{"metadata":{"vulnerabilities":{"critical":0,"high":0,"moderate":0,"low":0},"totalDependencies":5}}
+JSON
+
+# One high-severity advisory against vuln-pkg-a.
+cat > "$STUB_DIR/output-vuln-a.json" <<'JSON'
+{"metadata":{"vulnerabilities":{"critical":0,"high":1,"moderate":0,"low":0},"totalDependencies":5},"advisories":{"1":{"severity":"high","github_advisory_id":"GHSA-test-0001","module_name":"vuln-pkg-a","findings":[{"version":"1.2.3","paths":[]}]}}}
+JSON
+
+# Only vuln-pkg-b's advisory (used as the mixed case's BASE state -- pkg-a
+# is absent entirely, pkg-b is present and already flagged).
+cat > "$STUB_DIR/output-vuln-b-only.json" <<'JSON'
+{"metadata":{"vulnerabilities":{"critical":0,"high":1,"moderate":0,"low":0},"totalDependencies":5},"advisories":{"2":{"severity":"high","github_advisory_id":"GHSA-test-0002","module_name":"vuln-pkg-b","findings":[{"version":"2.0.0","paths":[]}]}}}
+JSON
+
+# Both advisories together (the mixed case's HEAD state).
+cat > "$STUB_DIR/output-vuln-a-b.json" <<'JSON'
+{"metadata":{"vulnerabilities":{"critical":0,"high":2,"moderate":0,"low":0},"totalDependencies":5},"advisories":{"1":{"severity":"high","github_advisory_id":"GHSA-test-0001","module_name":"vuln-pkg-a","findings":[{"version":"1.2.3","paths":[]}]},"2":{"severity":"high","github_advisory_id":"GHSA-test-0002","module_name":"vuln-pkg-b","findings":[{"version":"2.0.0","paths":[]}]}}}
+JSON
+
+# --- repo scaffolding --------------------------------------------------------
+# One workspace-level pnpm-lock.yaml so discovery finds exactly one tree,
+# matching the real incident (the workspace root, not a vendored tree).
+_write_lock() {
+  # $1 = destination file, $2 = STATE tag
+  cat > "$1" <<LOCK
+lockfileVersion: '9.0'
+# STATE:$2
+LOCK
+}
+
+_init_repo() {
+  # $1 = base STATE tag (what "dev" / origin/<base> holds)
+  # $2 = head STATE tag (what the PR branch under test holds)
+  base_state=$1
+  head_state=$2
+
+  rm -rf "$REPO_DIR"
+  mkdir -p "$REPO_DIR"
+  ( cd "$REPO_DIR" \
+    && git init -q -b trunk \
+    && git config user.email test@example.com \
+    && git config user.name "Test" )
+
+  _write_lock "$REPO_DIR/pnpm-lock.yaml" "$base_state"
+  ( cd "$REPO_DIR" && git add -A && git commit -q -m base )
+  # A literal branch named "origin/<base>" -- git tolerates slashes in
+  # branch names, so this resolves via `git show origin/<base>:<path>`
+  # exactly like a real remote-tracking ref would, with no remote required.
+  ( cd "$REPO_DIR" && git branch -q "origin/dev" )
+
+  if [ "$head_state" != "$base_state" ]; then
+    _write_lock "$REPO_DIR/pnpm-lock.yaml" "$head_state"
+    ( cd "$REPO_DIR" && git add -A && git commit -q -m "pr change" )
+  fi
+}
+
+# --- runner ------------------------------------------------------------------
+_run() {
+  # Runs the target script with GITHUB_BASE_REF set from $1 (empty string
+  # means unset -- a push/workflow_dispatch/merge_group context), cwd inside
+  # the synthetic repo, pnpm stubbed, PATH otherwise untouched (jq/git/grep
+  # are the real system tools, same as production).
+  base_ref=$1
+  (
+    cd "$REPO_DIR" || exit 97
+    PATH="$STUB_DIR:$PATH"
+    STUB_DIR_ENV="$STUB_DIR"
+    TMPDIR="$TMPROOT_DIR"
+    export PATH STUB_DIR_ENV TMPDIR
+    if [ -n "$base_ref" ]; then
+      GITHUB_BASE_REF="$base_ref"
+      export GITHUB_BASE_REF
+    else
+      unset GITHUB_BASE_REF
+    fi
+    sh "$TARGET"
+  ) >"$OUT_FILE" 2>&1
+  LAST_RC=$?
+}
+
+_assert_exit() {
+  name=$1
+  expected=$2
+  if [ "$LAST_RC" -eq "$expected" ]; then
+    echo "PASS: $name (exit $LAST_RC)"
+  else
+    echo "FAIL: $name -- expected exit $expected, got $LAST_RC"
+    echo "--- output ---"
+    cat "$OUT_FILE"
+    echo "--------------"
+    FAILURES=$((FAILURES + 1))
+  fi
+}
+
+_assert_output_contains() {
+  name=$1
+  needle=$2
+  if grep -qF "$needle" "$OUT_FILE"; then
+    echo "PASS: $name mentions '$needle'"
+  else
+    echo "FAIL: $name -- expected output to mention '$needle'"
+    echo "--- output ---"
+    cat "$OUT_FILE"
+    echo "--------------"
+    FAILURES=$((FAILURES + 1))
+  fi
+}
+
+# ==============================================================================
+# Case table (must-NOT-block first, then must-block), each run against the
+# real target script -- not a reimplementation of its logic.
+# ==============================================================================
+
+# 1. PRE-EXISTING, PR context, advisory UNCHANGED from base (the
+#    GHSA-p293-qw3h-jr36 / 2026-09-08 shape: same version on both sides of
+#    the diff). Must NOT block, and must say so as pre-existing rather than
+#    a flat red.
+_init_repo "vuln-a" "vuln-a"
+_run dev
+_assert_exit "pre-existing, advisory unchanged by diff" 0
+_assert_output_contains "pre-existing case names it as pre-existing" "pre-existing"
+_assert_output_contains "pre-existing case cites #2040" "#2040"
+
+# 2. INTRODUCED via upgrade: base had a clean lockfile, this diff's
+#    pnpm-lock.yaml moved it to the flagged version. Must block.
+_init_repo "clean" "vuln-a"
+_run dev
+_assert_exit "introduced by upgrade" 1
+_assert_output_contains "introduced-by-upgrade case names it as introduced" "introduced or upgraded by this diff"
+
+# 3. INTRODUCED via new dependency: base's lockfile carries no such package
+#    at all; this diff added it at an already-vulnerable version. For the
+#    advisory-ID-diffing design this is mechanically identical to case 2
+#    (base's audit reports no matching id either way) -- kept as its own
+#    case for documentation, matching py-dependency-audit-classification's
+#    own case 3, which IS mechanically distinct there because Python
+#    classifies per-package lockfile version rather than by diffing two
+#    full audit runs.
+_init_repo "clean" "vuln-a"
+_run dev
+_assert_exit "introduced via brand-new dependency" 1
+_assert_output_contains "new-dependency case names it as introduced" "introduced or upgraded by this diff"
+
+# 4. Non-PR context (push to the integration branch itself, or
+#    workflow_dispatch/merge_group -- GITHUB_BASE_REF unset). No diff exists
+#    to attribute the finding to, so the classification must NOT apply: any
+#    finding blocks, exactly as before this fix. Deliberately the SAME
+#    lockfile shape as case 1 (unchanged advisory) to prove the difference
+#    in outcome is driven by PR-context alone -- the scheduled base-branch
+#    scan added alongside this file (#2040) relies on exactly this: every
+#    current finding on `dev` must be reported, not just new ones.
+_init_repo "vuln-a" "vuln-a"
+_run ""
+_assert_exit "no PR context -- always blocks" 1
+
+# 5. PR context, but the base ref cannot be resolved locally (e.g. a shallow
+#    checkout, or a distributed copy running where fetch-depth: 0 was not
+#    honoured). Comparison fails CLOSED: blocks, same as before this fix,
+#    rather than silently waving a real regression through because the
+#    comparison itself could not be made.
+_init_repo "vuln-a" "vuln-a"
+_run "some-branch-that-was-never-fetched"
+_assert_exit "base ref unresolvable -- fails closed to blocking" 1
+_assert_output_contains "base ref unresolvable -- warns why" "does not resolve locally"
+
+# 6. Mixed tree: one pre-existing finding (vuln-pkg-b, unchanged from base)
+#    and one introduced finding (vuln-pkg-a, new to this diff) in the same
+#    run. Must still block overall (the introduced one), while the
+#    pre-existing one is still named as such rather than folded into an
+#    undifferentiated total.
+_init_repo "vuln-b-only" "vuln-a-b"
+_run dev
+_assert_exit "mixed tree -- introduced finding still blocks" 1
+_assert_output_contains "mixed tree -- introduced vuln-pkg-a is named" "vuln-pkg-a advisory GHSA-test-0001"
+_assert_output_contains "mixed tree -- pre-existing vuln-pkg-b is named separately" "vuln-pkg-b advisory GHSA-test-0002"
+_assert_output_contains "mixed tree -- pre-existing vuln-pkg-b says so" "pre-existing"
+
+# 7. Sanity: a clean run (no vulnerabilities at all) is unaffected by any of
+#    the above -- still exits 0, still audits normally with the new
+#    5-arg audit_dir signature.
+_init_repo "clean" "clean"
+_run dev
+_assert_exit "clean run unaffected" 0
+
+echo
+if [ "$FAILURES" -eq 0 ]; then
+  echo "js-dependency-audit-classification.test.sh: all checks passed."
+  exit 0
+else
+  echo "js-dependency-audit-classification.test.sh: $FAILURES check(s) failed."
+  exit 1
+fi

package/_skeletons/plugin-template/scripts/js-dependency-audit.sh

@@ -62,6 +62,50 @@
 # or the copies stop being interchangeable and `shared-sync.sh --check` starts
 # reporting drift that is really divergence.
 #
+# ## Pre-existing vs introduced (#2040)
+#
+# Every check above answers "can this audit be trusted" (network flake vs a
+# real finding). None of them answer WHEN the vulnerable version got there —
+# so a genuine high/critical advisory published overnight against a package
+# already sitting on `dev`, untouched by this diff, used to read identically
+# to a PR that actually introduced the vulnerable version. #1880 (2026-09-04)
+# tried to paper over exactly that by moving this whole check to a
+# `continue-on-error`, non-required job — which stopped a real per-PR finding
+# from blocking too, and produced ten separate biffo-fleet tickets and $86.72
+# of dispatch spend for two routine advisories that no PR under test could
+# have fixed (#2040's own cost accounting). `py-dependency-audit.sh` closed
+# this same gap for Python in #1673; this is the JS side of the same fix.
+#
+# The fix compares the ADVISORY IDS found against the SAME tree's pnpm audit
+# run against the PR's BASE branch, not against the diff itself: a PR can
+# leave pnpm-lock.yaml untouched while a sibling change moves a transitive
+# version, or the base branch may already carry the flagged version. An
+# advisory ID present in both base and head is pre-existing and does not
+# block; an advisory ID present only in head is introduced by this diff (a
+# new dependency, or an upgrade/downgrade into a vulnerable version) and
+# blocks exactly as before. This mirrors the issue's own "run against base
+# and head, diff the advisory IDs, fail on head-only" design rather than
+# hand-parsing pnpm-lock.yaml's YAML — `pnpm audit` already works against a
+# bare copy of just the lockfile with no install (verified directly against
+# this repo's own pnpm 9.15.9), so the base side is a second real audit
+# call, not a reimplementation of what `pnpm audit` already does.
+#
+# `GITHUB_BASE_REF` is the base branch name and is set ONLY for a
+# `pull_request`/`pull_request_target` event — empty on `push`,
+# `workflow_dispatch` and `merge_group`. That is deliberate, not a gap:
+# outside a PR there is no "diff" to attribute a finding to, so every finding
+# blocks exactly as before (the correct behaviour for `dev` itself, and for
+# the scheduled base-branch scan added alongside this file in #2040, which
+# wants every current finding reported, not just new ones).
+#
+# `origin/$GITHUB_BASE_REF` must already be a resolvable local ref for the
+# comparison to run at all — the `js` job's checkout uses `fetch-depth: 0`
+# precisely so it is (see that job's own comment). If it is NOT resolvable
+# (a shallow checkout, or a distributed copy of this script running
+# somewhere that checkout is missing), comparison fails CLOSED: every
+# finding blocks, same as before this fix, rather than silently waving a
+# real regression through because the check could not be performed.
+#
 # POSIX sh (the CI step runs `sh scripts/...`, i.e. dash) — no `pipefail`.
 set -u
 
@@ -118,12 +162,60 @@ failed=0
 # invocation has finished.
 #
 # `$1` is the directory, `$2` a human label, `$3` extra pnpm flags, `$4` the
-# result file this invocation must write its verdict to.
+# result file this invocation must write its verdict to, `$5` this tree's
+# pnpm-lock.yaml path relative to the repo root — used to look up the SAME
+# lockfile's advisories on the base branch (#2040) — never empty, every
+# caller passes one.
+#
+# Returns (on stdout) the set of advisory IDs recorded against the SAME
+# lockfile path on the PR's base branch, one per line — any severity, not
+# just high/critical, because presence is all classification needs. Prints
+# nothing and returns non-zero when a comparison genuinely cannot be made
+# (network/parse failure, a temp-dir failure) — the caller then treats every
+# finding as introduced, the same fail-closed default #1673 established for
+# Python. An empty base lockfile (the path did not exist on the base branch
+# at all — a brand-new lockfile or a brand-new vendored tree this diff
+# itself introduced) is NOT a failure: it prints nothing and returns 0,
+# because an empty set is the correct answer — there is nothing to be
+# pre-existing against, so every finding in a tree the base never had is
+# introduced by definition.
+_base_advisory_ids() {
+  lock_rel="$1"
+
+  base_content="$(git show "${BASE_REMOTE_REF}:${lock_rel}" 2>/dev/null)"
+  if [ -z "$base_content" ]; then
+    return 0
+  fi
+
+  workdir=$(mktemp -d "${TMPDIR:-/tmp}/js-dependency-audit-base.XXXXXX") || return 1
+  printf '%s' "$base_content" >"$workdir/pnpm-lock.yaml"
+
+  for attempt in $(seq 1 "$attempts"); do
+    # shellcheck disable=SC2086
+    base_out="$(cd "$workdir" && timeout "$AUDIT_TIMEOUT_SECS" pnpm audit --json --ignore-workspace 2>/dev/null)"
+    base_status=$?
+    if [ "$base_status" -eq 124 ]; then
+      [ "$attempt" -lt "$attempts" ] && sleep "$((attempt * 2))"
+      continue
+    fi
+    if printf '%s' "$base_out" | jq -e '.metadata.vulnerabilities' >/dev/null 2>&1; then
+      printf '%s' "$base_out" | jq -r '.advisories[]? | (.github_advisory_id // (.id|tostring))' 2>/dev/null
+      rm -rf "$workdir"
+      return 0
+    fi
+    [ "$attempt" -lt "$attempts" ] && sleep "$((attempt * 2))"
+  done
+
+  rm -rf "$workdir"
+  return 1
+}
+
 audit_dir() {
   dir="$1"
   label="$2"
   extra="$3"
   resultfile="$4"
+  lock_rel="$5"
 
   for attempt in $(seq 1 "$attempts"); do
     # printf, never echo: the CI step runs `sh scripts/...` i.e. dash, whose
@@ -172,10 +264,54 @@ audit_dir() {
       low="$(printf '%s' "$out" | jq '.metadata.vulnerabilities.low // 0')"
       total="$(printf '%s' "$out" | jq '.metadata.totalDependencies // 0')"
       if [ "$((high + crit))" -gt 0 ]; then
-        echo "::error::${label}: ${crit} critical + ${high} high advisory(ies) across ${total} package(s); registry answered ${seen_at}."
+        # Classify each qualifying (high/critical) advisory against the base
+        # branch's SAME lockfile before deciding to block (#2040). Written to
+        # a regular file, not a pipe, and read with `while read ... done <
+        # file` rather than `| while read`, for the same reason
+        # py-dependency-audit.sh's findings loop does: a pipeline runs the
+        # loop in a subshell, and a subshell's counter updates vanish the
+        # instant it exits.
+        findings_file="$(mktemp)"
+        printf '%s' "$out" | jq -r '.advisories[]? | select(.severity=="high" or .severity=="critical") | "\(.github_advisory_id // (.id|tostring))\t\(.severity)\t\(.module_name)"' >"$findings_file"
+
+        base_ids_file=""
+        base_available=0
+        if [ "$COMPARE_MODE" -eq 1 ]; then
+          candidate_ids="$(mktemp)"
+          if _base_advisory_ids "$lock_rel" >"$candidate_ids" 2>/dev/null; then
+            base_ids_file="$candidate_ids"
+            base_available=1
+          else
+            rm -f "$candidate_ids"
+          fi
+        fi
+
+        introduced_count=0
+        preexisting_count=0
+        while IFS="$(printf '\t')" read -r f_id f_sev f_mod; do
+          [ -z "$f_id" ] && continue
+          if [ "$base_available" -eq 1 ] && grep -qxF "$f_id" "$base_ids_file" 2>/dev/null; then
+            preexisting_count=$((preexisting_count + 1))
+            echo "::warning::${label}: ${f_mod} advisory ${f_id} (${f_sev}) is already present in ${BASE_REMOTE_REF}'s lockfile — pre-existing, not introduced by this diff (#2040)."
+          else
+            introduced_count=$((introduced_count + 1))
+            echo "::error::${label}: ${f_mod} advisory ${f_id} (${f_sev}) — new to this tree, or a version this diff introduced/upgraded (or a base-branch comparison was not possible)."
+          fi
+        done <"$findings_file"
+        rm -f "$findings_file"
+        [ -n "$base_ids_file" ] && rm -f "$base_ids_file"
+
         printf '%s' "$out" | jq '.advisories // .metadata.vulnerabilities' 2>/dev/null | head -c 4000
-        echo "fail" >"$resultfile"
-        return 1
+
+        if [ "$introduced_count" -gt 0 ]; then
+          echo "::error::${label}: ${introduced_count} critical/high advisory(ies) introduced or upgraded by this diff across ${total} package(s) (${preexisting_count} more pre-existing, not counted against it); registry answered ${seen_at}."
+          echo "fail" >"$resultfile"
+          return 1
+        fi
+
+        echo "${label}: ${preexisting_count} critical/high advisory(ies) found, all pre-existing on ${BASE_REMOTE_REF:-the base branch} and unrelated to this diff — not blocking (#2040); registry answered ${seen_at}."
+        echo "ok" >"$resultfile"
+        return 0
       fi
       # A bare "no advisories" is not falsifiable. State the population, the
       # severities that did NOT block, and when the registry was asked, so a
@@ -210,6 +346,23 @@ fi
 
 WORKSPACE_ABS=$(pwd -P)
 
+# Decide once, for the whole run, whether a base-branch comparison is even
+# possible (#2040 — see the "Pre-existing vs introduced" docstring above
+# `set -u`). `GITHUB_BASE_REF` is only ever set by a
+# `pull_request`/`pull_request_target` event; everywhere else COMPARE_MODE
+# stays 0 and every finding blocks, unchanged from before this fix.
+BASE_REMOTE_REF=""
+COMPARE_MODE=0
+if [ -n "${GITHUB_BASE_REF:-}" ]; then
+  candidate="origin/${GITHUB_BASE_REF}"
+  if git rev-parse --verify --quiet "${candidate}^{commit}" >/dev/null 2>&1; then
+    BASE_REMOTE_REF="$candidate"
+    COMPARE_MODE=1
+  else
+    echo "::warning::js-dependency-audit: base branch is '${GITHUB_BASE_REF}' but '${candidate}' does not resolve locally (shallow checkout?) — cannot tell a pre-existing finding from one this diff introduced, so every finding will block, same as before #2040."
+  fi
+fi
+
 # shellcheck disable=SC2016
 ALL_LOCKS=$(find "$REPO_ROOT" \
   \( -name node_modules -o -name .git -o -name .worktrees \) -prune -o \
@@ -286,10 +439,14 @@ for lock in $ALL_LOCKS; do
   esac
   i=$((i + 1))
   resultfile="$TMP_DIR/result.$i"
+  # `find` was rooted at $REPO_ROOT, so $lock is always an absolute path
+  # under it — this strip is unconditional, unlike $rel's dir_abs case above
+  # (which also has to tolerate a symlink resolving outside the root).
+  lock_rel=${lock#"$REPO_ROOT"/}
   if [ "$dir_abs" = "$WORKSPACE_ABS" ]; then
-    audit_dir "$dir" "pnpm audit (workspace: ${rel})" "" "$resultfile" &
+    audit_dir "$dir" "pnpm audit (workspace: ${rel})" "" "$resultfile" "$lock_rel" &
   else
-    audit_dir "$dir" "pnpm audit (${rel})" "--ignore-workspace" "$resultfile" &
+    audit_dir "$dir" "pnpm audit (${rel})" "--ignore-workspace" "$resultfile" "$lock_rel" &
   fi
 done
 

package/_skeletons/sibling-template/.github/workflows/ci.yml

@@ -53,7 +53,14 @@ jobs:
       run:
         working-directory: apps/frontend
     steps:
+      # `fetch-depth: 0` (biffo-template#2040) — the Dependency audit step
+      # below needs `origin/${GITHUB_BASE_REF}` to resolve locally for its
+      # pre-existing-vs-introduced comparison (biffo-template#1673's Python
+      # design, now shared by the JS script too), and the default shallow
+      # checkout does not carry it.
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          fetch-depth: 0
       - uses: pnpm/action-setup@v4
         with:
           version: 9.15.9
@@ -74,6 +81,27 @@ jobs:
       - name: Test
         if: ${{ !cancelled() }}
         run: pnpm run test
+      # Runs IN this required job again, rather than in a separate
+      # `continue-on-error` job, as of biffo-template#2040 — reverting the
+      # biffo-template#1880 split (see that repo's root `ci.yml` `js` job
+      # for the full reasoning this mirrors). #1880 moved this step out
+      # because a registry-side INCONCLUSIVE result could block real,
+      # unrelated PRs; that risk is unchanged and still accepted here. What
+      # changed: js-dependency-audit.sh now classifies findings as
+      # "pre-existing on the base branch" vs "introduced by this diff", so
+      # the routine case #1880 was reacting to — an advisory published
+      # against something already on `dev`, unrelated to any PR's diff — no
+      # longer blocks, and only a finding this diff actually introduced or
+      # upgraded into does.
+      #
+      # Path is relative: this job's working-directory is apps/frontend,
+      # which is exactly the tree to audit, and the script audits its own
+      # cwd — it is byte-identical to biffo-template's copy and to every
+      # other satellite's, distributed by that repo's shared-sync.sh, so it
+      # cannot assume a layout. Do not edit it here; edit it upstream.
+      - name: Dependency audit
+        if: ${{ !cancelled() }}
+        run: sh ../../scripts/js-dependency-audit.sh
       # Run with NO NEXT_PUBLIC_CORE_COGNITO_* in scope — this is now the
       # PERMANENT state, not a build-guard quirk. The frontend NEVER reads those
       # vars: it resolves the core's Cognito identity at runtime from
@@ -126,8 +154,8 @@ jobs:
         if: ${{ !cancelled() }}
         # This job's working-directory default is apps/frontend (top of this
         # job), but scripts/biffo.sh lives at the repo root -- same relative-
-        # path convention as the js-audit job's own
-        # `sh ../../scripts/js-dependency-audit.sh` below. A bare
+        # path convention as this job's own Dependency audit step's
+        # `sh ../../scripts/js-dependency-audit.sh` above. A bare
         # `scripts/biffo.sh` here fails unconditionally with "No such file",
         # on every run, regardless of whether there is a real
         # lambda-output/terraform-input violation (biffo-template#1983).
@@ -193,51 +221,6 @@ jobs:
       - name: E2E tests
         run: pnpm run e2e
 
-  # Split out of the `js` job deliberately (biffo-template#1880): `pnpm
-  # audit`'s registry call has been chronically, intermittently unreachable
-  # since npm/GitHub retired the legacy audit endpoints on 2026-07-15, an
-  # ongoing upstream infrastructure condition unrelated to this repo's own
-  # code. Mirrors biffo-template's own root `ci.yml` split; see that repo's
-  # `js-audit` job and #1880 for the full evidence. `js` (required) no
-  # longer runs this step, so a registry hang can never again block this
-  # required check; this job runs the exact same script informationally on
-  # every push/PR (`continue-on-error: true`) and is deliberately NOT part
-  # of DEFAULT_STATUS_CHECKS/SIBLING_STATUS_CHECKS.
-  js-audit:
-    name: JS Dependency Audit (non-blocking, #1880)
-    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
-    timeout-minutes: 20
-    continue-on-error: true
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 9.15.9
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: pnpm
-          cache-dependency-path: apps/frontend/pnpm-lock.yaml
-      - run: pnpm install --frozen-lockfile
-      - name: Dependency audit
-        if: ${{ !cancelled() }}
-        # Fails on a real high/critical advisory, but treats a broken audit
-        # registry (non-JSON response, or the chronic #1880 timeout) as
-        # INCONCLUSIVE rather than blocking (#591, #743) — and this job's own
-        # non-required status is what stops that inconclusive result from
-        # blocking the merge queue in the first place.
-        #
-        # The relative path is deliberate. This job's working-directory is
-        # apps/frontend, which is exactly the tree to audit, and the script
-        # audits its own cwd — it is byte-identical to biffo-template's copy
-        # and to every other satellite's, distributed by that repo's
-        # shared-sync.sh, so it cannot assume a layout. Do not edit it here;
-        # edit it upstream.
-        run: sh ../../scripts/js-dependency-audit.sh
-
   python:
     name: Python (lint, types, test, security)
     runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
@@ -246,14 +229,14 @@ jobs:
       run:
         working-directory: services/api
     steps:
-      # `fetch-depth: 0` is no longer required here (#1882): it existed
-      # solely for py-dependency-audit.sh's pre-existing-vs-introduced
-      # comparison (#1673), which needed `origin/${GITHUB_BASE_REF}` to
-      # resolve locally -- that step, and the same full-depth checkout it
-      # needs, moved to the `python-audit` job below when the audit was
-      # split out of this required job. Nothing remaining in this job reads
-      # `origin/` state, so the default shallow checkout is correct here now.
+      # `fetch-depth: 0` is required again (biffo-template#2040, reverting
+      # #1882's removal of it): the Dependency audit step below (folded back
+      # into this required job) needs `origin/${GITHUB_BASE_REF}` to resolve
+      # locally for py-dependency-audit.sh's pre-existing-vs-introduced
+      # comparison (#1673).
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          fetch-depth: 0
       - uses: astral-sh/setup-uv@v5
         with:
           enable-cache: true
@@ -264,6 +247,19 @@ jobs:
       # committed lock just stops describing what actually ran
       # (biffo-template#1731).
       - run: uv sync --all-groups --locked
+      # Runs IN this required job again, rather than in a separate
+      # `continue-on-error` job, as of biffo-template#2040 — reverting the
+      # biffo-template#1882 split (mirroring the identical `js`-side revert
+      # above; see that job's own comment for the full reasoning). What
+      # changed: py-dependency-audit.sh has classified findings as
+      # "pre-existing on the base branch" vs "introduced by this diff"
+      # since #1673, so the routine case #1882 was reacting to no longer
+      # blocks, and only a finding this diff actually introduced or
+      # upgraded into does. cwd is services/api, which is the environment
+      # `uv sync` installed and so the one to audit.
+      - name: Dependency audit
+        if: ${{ !cancelled() }}
+        run: sh ../../scripts/py-dependency-audit.sh
       - name: Lint
         if: ${{ !cancelled() }}
         run: uv run ruff check .
@@ -367,39 +363,6 @@ jobs:
         # *.test.sh guard is added with no run: line anywhere.
         run: sh scripts/guard-self-test-wiring.sh
 
-  # Split out of the `python` job deliberately (biffo-template#1882, mirroring
-  # #1880/#1881's identical JS-side fix): `pip-audit`'s advisory lookups are
-  # exactly as registry-dependent and chronically unreliable as `pnpm audit`'s
-  # were. `python` (required) no longer runs this step, so a registry-side
-  # advisory event can never again block that job; this job runs the exact
-  # same script informationally on every push/PR (`continue-on-error: true`)
-  # and is deliberately NOT part of DEFAULT_STATUS_CHECKS/SIBLING_STATUS_CHECKS.
-  python-audit:
-    name: Python Dependency Audit (non-blocking, #1882)
-    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
-    timeout-minutes: 20
-    continue-on-error: true
-    defaults:
-      run:
-        working-directory: services/api
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-        with:
-          fetch-depth: 0
-      - uses: astral-sh/setup-uv@v5
-        with:
-          enable-cache: true
-      - run: uv sync --all-groups --locked
-      - name: Dependency audit
-        if: ${{ !cancelled() }}
-        # Same treatment as the JS job's Dependency audit: fails on a real
-        # advisory, INCONCLUSIVE on an unreachable PyPI/OSV (#591, #743) —
-        # and this job's own non-required status is what stops that
-        # inconclusive result from blocking the merge queue in the first
-        # place. cwd is services/api, which is the environment `uv sync`
-        # installed and so the one to audit.
-        run: sh ../../scripts/py-dependency-audit.sh
-
   security-secrets:
     name: Secret Scan
     runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}

package/_skeletons/sibling-template/scripts/js-dependency-audit-classification.test.sh

@@ -0,0 +1,304 @@
+#!/usr/bin/env sh
+#
+# Proves js-dependency-audit.sh (#2040) distinguishes "this PR's diff
+# introduced or upgraded to a vulnerable package version" from "an advisory
+# was published against a version already sitting on the base branch,
+# unrelated to this diff" -- rather than reporting an identical red for both.
+# This is the JS side of the fix py-dependency-audit.sh already got in
+# #1673; see that file's own classification test for the Python case table
+# this one mirrors.
+#
+# The real incident this guards against: two routine npm advisories
+# (GHSA-p293-qw3h-jr36 / Next.js, GHSA-82fw-gwwq-j7x9 / vitest) were
+# published against packages already on `dev` on 2026-09-08/09, with no code
+# change anywhere -- and turned the JS lane red on every open PR at once,
+# producing 89 fleet dispatches across 61 units in 8 repos and 10 duplicate
+# tickets for one classifier bug (#2040's own cost accounting). Case 1 below
+# reconstructs exactly that shape: base and PR both pinned at the flagged
+# version, PR diff untouched.
+#
+# ## Real `pnpm audit --json` shape, captured live
+#
+# Run against this repo's own workspace (pnpm 9.15.9, 2026-09-10):
+#
+#   $ pnpm audit --json
+#   {
+#     "advisories": {
+#       "1090893": {
+#         "severity": "low",
+#         "module_name": "cli",
+#         "github_advisory_id": "GHSA-6cpc-mj5c-m9rq",
+#         "findings": [{"version": "0.0.0", "paths": []}],
+#         ...
+#       }
+#     },
+#     "metadata": {
+#       "vulnerabilities": {"info": 0, "low": 1, "moderate": 0, "high": 0, "critical": 0},
+#       "totalDependencies": 929
+#     }
+#   }
+#
+# `.advisories` is an OBJECT keyed by an internal numeric id, not an array --
+# `.advisories[]?` iterates its values the same as an array would. Each
+# value carries `.severity`, `.module_name` and `.github_advisory_id`, which
+# is exactly what js-dependency-audit.sh's classification reads. The fixture
+# JSON below is shaped to match this real structure, not invented -- the
+# OLD version of js-dependency-audit-parallel.test.sh's stub JSON carried
+# only `.metadata.vulnerabilities` with no `.advisories` key at all, which
+# classification silently read as zero findings (fixed alongside this file;
+# see that test's own updated `_fail_json` comment).
+#
+# Also proves `pnpm audit` runs against a BARE lockfile copy with no install
+# and no workspace context -- verified directly, not assumed:
+#
+#   $ mkdir /tmp/probe && cp pnpm-lock.yaml /tmp/probe/ && cd /tmp/probe
+#   $ pnpm audit --json --ignore-workspace   # exits 0, real advisory output
+#
+# which is why the base-branch side of this comparison is a second real
+# `pnpm audit` call against a `git show`-extracted copy of the lockfile,
+# not a hand-rolled pnpm-lock.yaml parser.
+#
+# Builds a real, tiny, throwaway git repo under mktemp (never under /tmp as
+# a full worktree copy -- this is a from-scratch repo with a handful of
+# files, not a copy of this repository's own object store -- see AGENTS.md's
+# "never create a git worktree ... under /tmp", which this is not) with a
+# base branch and a PR-head state, and stubs `pnpm` on PATH so `pnpm audit
+# --json` returns a canned finding selected by a marker comment inside
+# whichever pnpm-lock.yaml the stub is invoked against -- no network, no
+# real registry. `jq`, `git` and `grep` are used for real -- they are
+# exactly what the target script itself depends on, so stubbing them would
+# test nothing.
+#
+# Run: sh scripts/js-dependency-audit-classification.test.sh
+
+set -u
+
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+TARGET="$SCRIPT_DIR/js-dependency-audit.sh"
+
+REPO_DIR=$(mktemp -d)
+STUB_DIR=$(mktemp -d)
+TMPROOT_DIR=$(mktemp -d)
+OUT_FILE=$(mktemp)
+trap 'rm -rf "$REPO_DIR" "$STUB_DIR" "$TMPROOT_DIR"; rm -f "$OUT_FILE"' EXIT
+
+FAILURES=0
+
+# --- pnpm stub ---------------------------------------------------------------
+# Selected by a `# STATE:<tag>` marker comment inside whatever
+# pnpm-lock.yaml is in the CURRENT DIRECTORY when invoked -- the target
+# script always `cd`s into the tree it is auditing (the repo's own working
+# tree for the HEAD run, or a scratch dir holding a `git show`-extracted
+# copy for the BASE run), so the marker travels with whichever commit's
+# content is actually being read, exactly like a real lockfile diff would.
+cat > "$STUB_DIR/pnpm" <<'STUB'
+#!/usr/bin/env sh
+if [ "$1" = "audit" ]; then
+  state=$(grep -o 'STATE:[A-Za-z0-9_-]*' pnpm-lock.yaml 2>/dev/null | head -1 | cut -d: -f2)
+  out_file="$STUB_DIR_ENV/output-${state:-clean}.json"
+  if [ -f "$out_file" ]; then
+    cat "$out_file"
+  else
+    cat "$STUB_DIR_ENV/output-clean.json"
+  fi
+  exit 0
+fi
+echo "pnpm stub: unexpected invocation: $*" >&2
+exit 99
+STUB
+chmod +x "$STUB_DIR/pnpm"
+
+# --- fixture JSON, one per STATE tag ----------------------------------------
+cat > "$STUB_DIR/output-clean.json" <<'JSON'
+{"metadata":{"vulnerabilities":{"critical":0,"high":0,"moderate":0,"low":0},"totalDependencies":5}}
+JSON
+
+# One high-severity advisory against vuln-pkg-a.
+cat > "$STUB_DIR/output-vuln-a.json" <<'JSON'
+{"metadata":{"vulnerabilities":{"critical":0,"high":1,"moderate":0,"low":0},"totalDependencies":5},"advisories":{"1":{"severity":"high","github_advisory_id":"GHSA-test-0001","module_name":"vuln-pkg-a","findings":[{"version":"1.2.3","paths":[]}]}}}
+JSON
+
+# Only vuln-pkg-b's advisory (used as the mixed case's BASE state -- pkg-a
+# is absent entirely, pkg-b is present and already flagged).
+cat > "$STUB_DIR/output-vuln-b-only.json" <<'JSON'
+{"metadata":{"vulnerabilities":{"critical":0,"high":1,"moderate":0,"low":0},"totalDependencies":5},"advisories":{"2":{"severity":"high","github_advisory_id":"GHSA-test-0002","module_name":"vuln-pkg-b","findings":[{"version":"2.0.0","paths":[]}]}}}
+JSON
+
+# Both advisories together (the mixed case's HEAD state).
+cat > "$STUB_DIR/output-vuln-a-b.json" <<'JSON'
+{"metadata":{"vulnerabilities":{"critical":0,"high":2,"moderate":0,"low":0},"totalDependencies":5},"advisories":{"1":{"severity":"high","github_advisory_id":"GHSA-test-0001","module_name":"vuln-pkg-a","findings":[{"version":"1.2.3","paths":[]}]},"2":{"severity":"high","github_advisory_id":"GHSA-test-0002","module_name":"vuln-pkg-b","findings":[{"version":"2.0.0","paths":[]}]}}}
+JSON
+
+# --- repo scaffolding --------------------------------------------------------
+# One workspace-level pnpm-lock.yaml so discovery finds exactly one tree,
+# matching the real incident (the workspace root, not a vendored tree).
+_write_lock() {
+  # $1 = destination file, $2 = STATE tag
+  cat > "$1" <<LOCK
+lockfileVersion: '9.0'
+# STATE:$2
+LOCK
+}
+
+_init_repo() {
+  # $1 = base STATE tag (what "dev" / origin/<base> holds)
+  # $2 = head STATE tag (what the PR branch under test holds)
+  base_state=$1
+  head_state=$2
+
+  rm -rf "$REPO_DIR"
+  mkdir -p "$REPO_DIR"
+  ( cd "$REPO_DIR" \
+    && git init -q -b trunk \
+    && git config user.email test@example.com \
+    && git config user.name "Test" )
+
+  _write_lock "$REPO_DIR/pnpm-lock.yaml" "$base_state"
+  ( cd "$REPO_DIR" && git add -A && git commit -q -m base )
+  # A literal branch named "origin/<base>" -- git tolerates slashes in
+  # branch names, so this resolves via `git show origin/<base>:<path>`
+  # exactly like a real remote-tracking ref would, with no remote required.
+  ( cd "$REPO_DIR" && git branch -q "origin/dev" )
+
+  if [ "$head_state" != "$base_state" ]; then
+    _write_lock "$REPO_DIR/pnpm-lock.yaml" "$head_state"
+    ( cd "$REPO_DIR" && git add -A && git commit -q -m "pr change" )
+  fi
+}
+
+# --- runner ------------------------------------------------------------------
+_run() {
+  # Runs the target script with GITHUB_BASE_REF set from $1 (empty string
+  # means unset -- a push/workflow_dispatch/merge_group context), cwd inside
+  # the synthetic repo, pnpm stubbed, PATH otherwise untouched (jq/git/grep
+  # are the real system tools, same as production).
+  base_ref=$1
+  (
+    cd "$REPO_DIR" || exit 97
+    PATH="$STUB_DIR:$PATH"
+    STUB_DIR_ENV="$STUB_DIR"
+    TMPDIR="$TMPROOT_DIR"
+    export PATH STUB_DIR_ENV TMPDIR
+    if [ -n "$base_ref" ]; then
+      GITHUB_BASE_REF="$base_ref"
+      export GITHUB_BASE_REF
+    else
+      unset GITHUB_BASE_REF
+    fi
+    sh "$TARGET"
+  ) >"$OUT_FILE" 2>&1
+  LAST_RC=$?
+}
+
+_assert_exit() {
+  name=$1
+  expected=$2
+  if [ "$LAST_RC" -eq "$expected" ]; then
+    echo "PASS: $name (exit $LAST_RC)"
+  else
+    echo "FAIL: $name -- expected exit $expected, got $LAST_RC"
+    echo "--- output ---"
+    cat "$OUT_FILE"
+    echo "--------------"
+    FAILURES=$((FAILURES + 1))
+  fi
+}
+
+_assert_output_contains() {
+  name=$1
+  needle=$2
+  if grep -qF "$needle" "$OUT_FILE"; then
+    echo "PASS: $name mentions '$needle'"
+  else
+    echo "FAIL: $name -- expected output to mention '$needle'"
+    echo "--- output ---"
+    cat "$OUT_FILE"
+    echo "--------------"
+    FAILURES=$((FAILURES + 1))
+  fi
+}
+
+# ==============================================================================
+# Case table (must-NOT-block first, then must-block), each run against the
+# real target script -- not a reimplementation of its logic.
+# ==============================================================================
+
+# 1. PRE-EXISTING, PR context, advisory UNCHANGED from base (the
+#    GHSA-p293-qw3h-jr36 / 2026-09-08 shape: same version on both sides of
+#    the diff). Must NOT block, and must say so as pre-existing rather than
+#    a flat red.
+_init_repo "vuln-a" "vuln-a"
+_run dev
+_assert_exit "pre-existing, advisory unchanged by diff" 0
+_assert_output_contains "pre-existing case names it as pre-existing" "pre-existing"
+_assert_output_contains "pre-existing case cites #2040" "#2040"
+
+# 2. INTRODUCED via upgrade: base had a clean lockfile, this diff's
+#    pnpm-lock.yaml moved it to the flagged version. Must block.
+_init_repo "clean" "vuln-a"
+_run dev
+_assert_exit "introduced by upgrade" 1
+_assert_output_contains "introduced-by-upgrade case names it as introduced" "introduced or upgraded by this diff"
+
+# 3. INTRODUCED via new dependency: base's lockfile carries no such package
+#    at all; this diff added it at an already-vulnerable version. For the
+#    advisory-ID-diffing design this is mechanically identical to case 2
+#    (base's audit reports no matching id either way) -- kept as its own
+#    case for documentation, matching py-dependency-audit-classification's
+#    own case 3, which IS mechanically distinct there because Python
+#    classifies per-package lockfile version rather than by diffing two
+#    full audit runs.
+_init_repo "clean" "vuln-a"
+_run dev
+_assert_exit "introduced via brand-new dependency" 1
+_assert_output_contains "new-dependency case names it as introduced" "introduced or upgraded by this diff"
+
+# 4. Non-PR context (push to the integration branch itself, or
+#    workflow_dispatch/merge_group -- GITHUB_BASE_REF unset). No diff exists
+#    to attribute the finding to, so the classification must NOT apply: any
+#    finding blocks, exactly as before this fix. Deliberately the SAME
+#    lockfile shape as case 1 (unchanged advisory) to prove the difference
+#    in outcome is driven by PR-context alone -- the scheduled base-branch
+#    scan added alongside this file (#2040) relies on exactly this: every
+#    current finding on `dev` must be reported, not just new ones.
+_init_repo "vuln-a" "vuln-a"
+_run ""
+_assert_exit "no PR context -- always blocks" 1
+
+# 5. PR context, but the base ref cannot be resolved locally (e.g. a shallow
+#    checkout, or a distributed copy running where fetch-depth: 0 was not
+#    honoured). Comparison fails CLOSED: blocks, same as before this fix,
+#    rather than silently waving a real regression through because the
+#    comparison itself could not be made.
+_init_repo "vuln-a" "vuln-a"
+_run "some-branch-that-was-never-fetched"
+_assert_exit "base ref unresolvable -- fails closed to blocking" 1
+_assert_output_contains "base ref unresolvable -- warns why" "does not resolve locally"
+
+# 6. Mixed tree: one pre-existing finding (vuln-pkg-b, unchanged from base)
+#    and one introduced finding (vuln-pkg-a, new to this diff) in the same
+#    run. Must still block overall (the introduced one), while the
+#    pre-existing one is still named as such rather than folded into an
+#    undifferentiated total.
+_init_repo "vuln-b-only" "vuln-a-b"
+_run dev
+_assert_exit "mixed tree -- introduced finding still blocks" 1
+_assert_output_contains "mixed tree -- introduced vuln-pkg-a is named" "vuln-pkg-a advisory GHSA-test-0001"
+_assert_output_contains "mixed tree -- pre-existing vuln-pkg-b is named separately" "vuln-pkg-b advisory GHSA-test-0002"
+_assert_output_contains "mixed tree -- pre-existing vuln-pkg-b says so" "pre-existing"
+
+# 7. Sanity: a clean run (no vulnerabilities at all) is unaffected by any of
+#    the above -- still exits 0, still audits normally with the new
+#    5-arg audit_dir signature.
+_init_repo "clean" "clean"
+_run dev
+_assert_exit "clean run unaffected" 0
+
+echo
+if [ "$FAILURES" -eq 0 ]; then
+  echo "js-dependency-audit-classification.test.sh: all checks passed."
+  exit 0
+else
+  echo "js-dependency-audit-classification.test.sh: $FAILURES check(s) failed."
+  exit 1
+fi

package/_skeletons/sibling-template/scripts/js-dependency-audit.sh

@@ -62,6 +62,50 @@
 # or the copies stop being interchangeable and `shared-sync.sh --check` starts
 # reporting drift that is really divergence.
 #
+# ## Pre-existing vs introduced (#2040)
+#
+# Every check above answers "can this audit be trusted" (network flake vs a
+# real finding). None of them answer WHEN the vulnerable version got there —
+# so a genuine high/critical advisory published overnight against a package
+# already sitting on `dev`, untouched by this diff, used to read identically
+# to a PR that actually introduced the vulnerable version. #1880 (2026-09-04)
+# tried to paper over exactly that by moving this whole check to a
+# `continue-on-error`, non-required job — which stopped a real per-PR finding
+# from blocking too, and produced ten separate biffo-fleet tickets and $86.72
+# of dispatch spend for two routine advisories that no PR under test could
+# have fixed (#2040's own cost accounting). `py-dependency-audit.sh` closed
+# this same gap for Python in #1673; this is the JS side of the same fix.
+#
+# The fix compares the ADVISORY IDS found against the SAME tree's pnpm audit
+# run against the PR's BASE branch, not against the diff itself: a PR can
+# leave pnpm-lock.yaml untouched while a sibling change moves a transitive
+# version, or the base branch may already carry the flagged version. An
+# advisory ID present in both base and head is pre-existing and does not
+# block; an advisory ID present only in head is introduced by this diff (a
+# new dependency, or an upgrade/downgrade into a vulnerable version) and
+# blocks exactly as before. This mirrors the issue's own "run against base
+# and head, diff the advisory IDs, fail on head-only" design rather than
+# hand-parsing pnpm-lock.yaml's YAML — `pnpm audit` already works against a
+# bare copy of just the lockfile with no install (verified directly against
+# this repo's own pnpm 9.15.9), so the base side is a second real audit
+# call, not a reimplementation of what `pnpm audit` already does.
+#
+# `GITHUB_BASE_REF` is the base branch name and is set ONLY for a
+# `pull_request`/`pull_request_target` event — empty on `push`,
+# `workflow_dispatch` and `merge_group`. That is deliberate, not a gap:
+# outside a PR there is no "diff" to attribute a finding to, so every finding
+# blocks exactly as before (the correct behaviour for `dev` itself, and for
+# the scheduled base-branch scan added alongside this file in #2040, which
+# wants every current finding reported, not just new ones).
+#
+# `origin/$GITHUB_BASE_REF` must already be a resolvable local ref for the
+# comparison to run at all — the `js` job's checkout uses `fetch-depth: 0`
+# precisely so it is (see that job's own comment). If it is NOT resolvable
+# (a shallow checkout, or a distributed copy of this script running
+# somewhere that checkout is missing), comparison fails CLOSED: every
+# finding blocks, same as before this fix, rather than silently waving a
+# real regression through because the check could not be performed.
+#
 # POSIX sh (the CI step runs `sh scripts/...`, i.e. dash) — no `pipefail`.
 set -u
 
@@ -118,12 +162,60 @@ failed=0
 # invocation has finished.
 #
 # `$1` is the directory, `$2` a human label, `$3` extra pnpm flags, `$4` the
-# result file this invocation must write its verdict to.
+# result file this invocation must write its verdict to, `$5` this tree's
+# pnpm-lock.yaml path relative to the repo root — used to look up the SAME
+# lockfile's advisories on the base branch (#2040) — never empty, every
+# caller passes one.
+#
+# Returns (on stdout) the set of advisory IDs recorded against the SAME
+# lockfile path on the PR's base branch, one per line — any severity, not
+# just high/critical, because presence is all classification needs. Prints
+# nothing and returns non-zero when a comparison genuinely cannot be made
+# (network/parse failure, a temp-dir failure) — the caller then treats every
+# finding as introduced, the same fail-closed default #1673 established for
+# Python. An empty base lockfile (the path did not exist on the base branch
+# at all — a brand-new lockfile or a brand-new vendored tree this diff
+# itself introduced) is NOT a failure: it prints nothing and returns 0,
+# because an empty set is the correct answer — there is nothing to be
+# pre-existing against, so every finding in a tree the base never had is
+# introduced by definition.
+_base_advisory_ids() {
+  lock_rel="$1"
+
+  base_content="$(git show "${BASE_REMOTE_REF}:${lock_rel}" 2>/dev/null)"
+  if [ -z "$base_content" ]; then
+    return 0
+  fi
+
+  workdir=$(mktemp -d "${TMPDIR:-/tmp}/js-dependency-audit-base.XXXXXX") || return 1
+  printf '%s' "$base_content" >"$workdir/pnpm-lock.yaml"
+
+  for attempt in $(seq 1 "$attempts"); do
+    # shellcheck disable=SC2086
+    base_out="$(cd "$workdir" && timeout "$AUDIT_TIMEOUT_SECS" pnpm audit --json --ignore-workspace 2>/dev/null)"
+    base_status=$?
+    if [ "$base_status" -eq 124 ]; then
+      [ "$attempt" -lt "$attempts" ] && sleep "$((attempt * 2))"
+      continue
+    fi
+    if printf '%s' "$base_out" | jq -e '.metadata.vulnerabilities' >/dev/null 2>&1; then
+      printf '%s' "$base_out" | jq -r '.advisories[]? | (.github_advisory_id // (.id|tostring))' 2>/dev/null
+      rm -rf "$workdir"
+      return 0
+    fi
+    [ "$attempt" -lt "$attempts" ] && sleep "$((attempt * 2))"
+  done
+
+  rm -rf "$workdir"
+  return 1
+}
+
 audit_dir() {
   dir="$1"
   label="$2"
   extra="$3"
   resultfile="$4"
+  lock_rel="$5"
 
   for attempt in $(seq 1 "$attempts"); do
     # printf, never echo: the CI step runs `sh scripts/...` i.e. dash, whose
@@ -172,10 +264,54 @@ audit_dir() {
       low="$(printf '%s' "$out" | jq '.metadata.vulnerabilities.low // 0')"
       total="$(printf '%s' "$out" | jq '.metadata.totalDependencies // 0')"
       if [ "$((high + crit))" -gt 0 ]; then
-        echo "::error::${label}: ${crit} critical + ${high} high advisory(ies) across ${total} package(s); registry answered ${seen_at}."
+        # Classify each qualifying (high/critical) advisory against the base
+        # branch's SAME lockfile before deciding to block (#2040). Written to
+        # a regular file, not a pipe, and read with `while read ... done <
+        # file` rather than `| while read`, for the same reason
+        # py-dependency-audit.sh's findings loop does: a pipeline runs the
+        # loop in a subshell, and a subshell's counter updates vanish the
+        # instant it exits.
+        findings_file="$(mktemp)"
+        printf '%s' "$out" | jq -r '.advisories[]? | select(.severity=="high" or .severity=="critical") | "\(.github_advisory_id // (.id|tostring))\t\(.severity)\t\(.module_name)"' >"$findings_file"
+
+        base_ids_file=""
+        base_available=0
+        if [ "$COMPARE_MODE" -eq 1 ]; then
+          candidate_ids="$(mktemp)"
+          if _base_advisory_ids "$lock_rel" >"$candidate_ids" 2>/dev/null; then
+            base_ids_file="$candidate_ids"
+            base_available=1
+          else
+            rm -f "$candidate_ids"
+          fi
+        fi
+
+        introduced_count=0
+        preexisting_count=0
+        while IFS="$(printf '\t')" read -r f_id f_sev f_mod; do
+          [ -z "$f_id" ] && continue
+          if [ "$base_available" -eq 1 ] && grep -qxF "$f_id" "$base_ids_file" 2>/dev/null; then
+            preexisting_count=$((preexisting_count + 1))
+            echo "::warning::${label}: ${f_mod} advisory ${f_id} (${f_sev}) is already present in ${BASE_REMOTE_REF}'s lockfile — pre-existing, not introduced by this diff (#2040)."
+          else
+            introduced_count=$((introduced_count + 1))
+            echo "::error::${label}: ${f_mod} advisory ${f_id} (${f_sev}) — new to this tree, or a version this diff introduced/upgraded (or a base-branch comparison was not possible)."
+          fi
+        done <"$findings_file"
+        rm -f "$findings_file"
+        [ -n "$base_ids_file" ] && rm -f "$base_ids_file"
+
         printf '%s' "$out" | jq '.advisories // .metadata.vulnerabilities' 2>/dev/null | head -c 4000
-        echo "fail" >"$resultfile"
-        return 1
+
+        if [ "$introduced_count" -gt 0 ]; then
+          echo "::error::${label}: ${introduced_count} critical/high advisory(ies) introduced or upgraded by this diff across ${total} package(s) (${preexisting_count} more pre-existing, not counted against it); registry answered ${seen_at}."
+          echo "fail" >"$resultfile"
+          return 1
+        fi
+
+        echo "${label}: ${preexisting_count} critical/high advisory(ies) found, all pre-existing on ${BASE_REMOTE_REF:-the base branch} and unrelated to this diff — not blocking (#2040); registry answered ${seen_at}."
+        echo "ok" >"$resultfile"
+        return 0
       fi
       # A bare "no advisories" is not falsifiable. State the population, the
       # severities that did NOT block, and when the registry was asked, so a
@@ -210,6 +346,23 @@ fi
 
 WORKSPACE_ABS=$(pwd -P)
 
+# Decide once, for the whole run, whether a base-branch comparison is even
+# possible (#2040 — see the "Pre-existing vs introduced" docstring above
+# `set -u`). `GITHUB_BASE_REF` is only ever set by a
+# `pull_request`/`pull_request_target` event; everywhere else COMPARE_MODE
+# stays 0 and every finding blocks, unchanged from before this fix.
+BASE_REMOTE_REF=""
+COMPARE_MODE=0
+if [ -n "${GITHUB_BASE_REF:-}" ]; then
+  candidate="origin/${GITHUB_BASE_REF}"
+  if git rev-parse --verify --quiet "${candidate}^{commit}" >/dev/null 2>&1; then
+    BASE_REMOTE_REF="$candidate"
+    COMPARE_MODE=1
+  else
+    echo "::warning::js-dependency-audit: base branch is '${GITHUB_BASE_REF}' but '${candidate}' does not resolve locally (shallow checkout?) — cannot tell a pre-existing finding from one this diff introduced, so every finding will block, same as before #2040."
+  fi
+fi
+
 # shellcheck disable=SC2016
 ALL_LOCKS=$(find "$REPO_ROOT" \
   \( -name node_modules -o -name .git -o -name .worktrees \) -prune -o \
@@ -286,10 +439,14 @@ for lock in $ALL_LOCKS; do
   esac
   i=$((i + 1))
   resultfile="$TMP_DIR/result.$i"
+  # `find` was rooted at $REPO_ROOT, so $lock is always an absolute path
+  # under it — this strip is unconditional, unlike $rel's dir_abs case above
+  # (which also has to tolerate a symlink resolving outside the root).
+  lock_rel=${lock#"$REPO_ROOT"/}
   if [ "$dir_abs" = "$WORKSPACE_ABS" ]; then
-    audit_dir "$dir" "pnpm audit (workspace: ${rel})" "" "$resultfile" &
+    audit_dir "$dir" "pnpm audit (workspace: ${rel})" "" "$resultfile" "$lock_rel" &
   else
-    audit_dir "$dir" "pnpm audit (${rel})" "--ignore-workspace" "$resultfile" &
+    audit_dir "$dir" "pnpm audit (${rel})" "--ignore-workspace" "$resultfile" "$lock_rel" &
   fi
 done
 

package/dist/index.js

@@ -7632,10 +7632,6 @@ function rewriteDesignTokens(targetDir, tokens) {
       "    timeout-minutes: 20\n    defaults:\n      run:\n        working-directory: apps/frontend\n    steps:",
       "    timeout-minutes: 20\n    permissions:\n      contents: read\n      packages: read\n    defaults:\n      run:\n        working-directory: apps/frontend\n    steps:"
     );
-    yml = yml.replace(
-      "    continue-on-error: true\n    defaults:\n      run:\n        working-directory: apps/frontend\n    steps:",
-      "    continue-on-error: true\n    permissions:\n      contents: read\n      packages: read\n    defaults:\n      run:\n        working-directory: apps/frontend\n    steps:"
-    );
     yml = yml.replace(
       /( {6}- run: pnpm install --frozen-lockfile)\n(?! {8}env:)/g,
       "$1\n        env:\n          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.315.7",
+  "version": "0.315.8",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",