@cosmicdrift/kumiko-guards 0.350.0 → 0.351.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.350.0",
+  "version": "0.351.0",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -28,7 +28,7 @@
     "kumiko-pre-push": "./src/pre-push.sh"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.350.0",
+    "@cosmicdrift/kumiko-repo-manifest": "0.351.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/_lib/guard-kit.ts

@@ -239,6 +239,8 @@ export function baselineRatchet(args: {
       }));
     }
     if (!existsSync(args.file)) {
+      // Nothing to freeze: a missing baseline is equivalent to an empty one.
+      if (Object.values(current).every((count) => count === 0)) return [];
       console.log(
         `  No baseline found (${args.file}). Freeze it first with \`--write-baseline\` — warning until then, no fail.`,
       );

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.351.0",
+    "type": "fix",
+    "title": "A missing guard baseline with zero findings is clean instead of warning",
+    "detail": "A guard without a baseline file and without findings passes quietly\nGuards with a baseline ratchet printed the \"No baseline found\" warning in every consumer, even when they found nothing. A missing baseline now counts as an empty one when the current count is zero. `raw-sql` uses the same ratchet."
+  },
   {
     "version": "0.347.0",
     "type": "improvement",

package/src/guard-raw-sql.ts

@@ -17,7 +17,6 @@
  *   (or `kumiko-guards checks --write-baseline --guard=guard-raw-sql`)
  */
 
-import { existsSync } from "node:fs";
 import path from "node:path";
 import {
   baselineRatchet,
@@ -137,15 +136,11 @@ export const check: RepoCheck = {
       return { violations: [], matchedFiles: 0, notApplicable: true };
     }
     const { findings, markers, scannedFiles } = await scanAllRepos(applicableRoots);
-    // A root without markers and without a baseline has nothing to freeze, so it
-    // skips the ratchet's "no baseline found" warning instead of nagging every consumer.
-    const markerViolations: GuardViolation[] = markers
-      .filter((m) => m.linesByKey.size > 0 || existsSync(path.join(m.root.absPath, BASELINE_FILE)))
-      .flatMap((m) =>
-        ratchetFor(m.root).check(countsOf(m), MARKER_REMEDIATION, {
-          resolveLine: (key) => m.linesByKey.get(key)?.[0] ?? 1,
-        }),
-      );
+    const markerViolations: GuardViolation[] = markers.flatMap((m) =>
+      ratchetFor(m.root).check(countsOf(m), MARKER_REMEDIATION, {
+        resolveLine: (key) => m.linesByKey.get(key)?.[0] ?? 1,
+      }),
+    );
     return {
       violations: [
         ...findings.map((f) => ({

package/src/guard-upgrade-state.ts

@@ -4,8 +4,8 @@
  * caught up with the installed Kumiko framework version.
  *
  * The marker is written by `kumiko-upgrade --apply` (local bin from
- * `@cosmicdrift/kumiko-dev-server`) and records the version it was applied
- * at. This guard re-runs `kumiko-upgrade --from <marker version> --json` and
+ * `@cosmicdrift/kumiko-cli` or `@cosmicdrift/kumiko-dev-server`) and records
+ * the version it was applied at. This guard re-runs `kumiko-upgrade --from <marker version> --json` and
  * fails if any changelog entries are still pending — meaning the marker is
  * stale and the repo hasn't run the upgrade since.
  *
@@ -138,7 +138,7 @@ export async function runKumikoUpgrade(
     return {
       ok: false,
       error:
-        "`kumiko-upgrade` not resolvable — add `@cosmicdrift/kumiko-dev-server` as a devDependency or repair the install",
+        "`kumiko-upgrade` not resolvable — add `@cosmicdrift/kumiko-cli` or `@cosmicdrift/kumiko-dev-server` as a devDependency or repair the install",
     };
   }
   const proc = Bun.spawn({