code-foundry 1.48.5 → 1.48.6

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.48.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.5...v1.48.6) (2026-10-23)
+
+
+### Bug Fixes
+
+* **release:** audit generated release content for stale snapshots ([#775](https://github.com/0xPlayerOne/code-foundry/issues/775)) ([f842c27](https://github.com/0xPlayerOne/code-foundry/commit/f842c271e6b270b63a6d9b839795a849237c7a7d))
+
 ## [1.48.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.4...v1.48.5) (2026-10-22)
 
 
@@ -133,16 +140,9 @@
 
 * **billing:** run fast-lane executes concurrently ([#738](https://github.com/0xPlayerOne/code-foundry/issues/738)) ([b40e82a](https://github.com/0xPlayerOne/code-foundry/commit/b40e82a0709b288a8be46998cfdc8b909f92c23c))
 
-## [1.45.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.45.1...v1.45.2) (2026-10-06)
-
-
-### Bug Fixes
-
-* **billing:** emit the codeql input as a YAML boolean ([#735](https://github.com/0xPlayerOne/code-foundry/issues/735)) ([e0b348c](https://github.com/0xPlayerOne/code-foundry/commit/e0b348c9a3c730e46210fe0b9dc46af49c9db605))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 253 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 254 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/RELEASES.md

@@ -108,6 +108,35 @@ and sync never overwrites existing manifest versions. Legacy configs without
 manifest; `code-foundry doctor` fails when a manifest-mode config is missing
 its manifest.
 
+## Generated release content audit
+
+Release Please writes the release commit from file bodies it reads over the
+GitHub API. A run that starts on one push and finishes after another can commit
+bodies read before the second push onto the newer `main`, so the version PR
+silently reverts the merged change inside an approved file (agent-sim #133
+reverted `@adea-ai/ui` from `^0.144.0` to `^0.143.0` in six `package.json`
+files). A path audit cannot see this, because every changed path is an approved
+release file.
+
+Both release checks therefore read the unified diff against the base and require
+every added or removed line to be a release mutation: a version assignment
+(`"version": "1.2.3"`, `version = "1.2.3"`, a bare version file, a line carrying
+an `x-release-please-*` annotation, or a `jsonpath` key declared in
+`extra-files`), a `.release-please-manifest.json` package version, or an addition
+to a changelog. Any other change, a deleted file, or a rename fails closed and
+names the file and the first offending lines. A minified single-line JSON
+manifest passes when only its version keys differ. An unreadable diff also
+fails; it is never treated as empty.
+
+- `validation release_diff` (the required release-tier gate) audits
+  `base...HEAD` of the pull request merge commit, so a branch that is behind
+  `main` is judged by what merging it would do.
+- `release validate-prs` audits `gh pr diff` before auto-merge is requested.
+
+A failed audit leaves the version PR unmerged. Re-run the Release workflow
+(`workflow_dispatch`) so Release Please regenerates the branch from the current
+`main`; do not edit the generated branch or release manually.
+
 ## Pull request permissions
 
 The release job validates the configured automation token

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.48.5",
+  "version": "1.48.6",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/release.mjs

@@ -7,6 +7,7 @@ import { spawnSync } from 'node:child_process'
 import {
   approvedReleaseFiles,
   buildReleaseRecoveryPlan,
+  auditReleaseDiffContent,
   buildReconciliationPullRequestBody,
   classifyReconciliation,
   readReleaseConfig,
@@ -794,6 +795,8 @@ export function validateReleasePullRequestDiffs(root) {
   const paths = new Map()
   /** @type {string[]} */
   const headErrors = []
+  /** @type {string[]} */
+  const contentErrors = []
   for (const pr of generated) {
     const number = Number(pr.number)
     const result = spawnSync(
@@ -803,6 +806,25 @@ export function validateReleasePullRequestDiffs(root) {
     )
     paths.set(number, result.status === 0 ? result.stdout.split(/\r?\n/).filter(Boolean) : [])
 
+    // Paths prove only which files changed. Audit the content too, so a release
+    // generated from a stale snapshot cannot revert merged changes inside an
+    // approved file and still be queued for merge.
+    const content = spawnSync(
+      'gh',
+      ['pr', 'diff', String(number), '--repo', repository, '--color', 'never'],
+      { cwd: resolve(root), encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }
+    )
+    if (content.status === 0) {
+      for (const error of auditReleaseDiffContent(content.stdout, {
+        config: readReleaseConfig(root),
+      }))
+        contentErrors.push(`Generated release PR #${number}: ${error}`)
+    } else {
+      contentErrors.push(
+        `Generated release PR #${number}: unable to read its content diff; refusing to pass an unaudited release PR.`
+      )
+    }
+
     const auditedHead = typeof pr.headRefOid === 'string' ? pr.headRefOid : ''
     const currentPr = ghJson(root, [
       'pr',
@@ -828,9 +850,9 @@ export function validateReleasePullRequestDiffs(root) {
     paths,
     approvedReleaseFiles(readReleaseConfig(root))
   )
-  if (headErrors.length) {
+  if (headErrors.length || contentErrors.length) {
     validation.valid = false
-    validation.errors.push(...headErrors)
+    validation.errors.push(...headErrors, ...contentErrors)
   }
   console.log(JSON.stringify(validation, null, 2))
   if (!validation.valid) throw new Error(validation.errors.join(' '))

package/src/lib/release-policy.mjs

@@ -209,6 +209,187 @@ export function validateReleasePullRequests(prs, changedPathsByPr, allowed) {
   return { valid: errors.length === 0, generated, errors }
 }
 
+/** A `key = value` or `"key": value` assignment whose key names a version. */
+const VERSION_ASSIGNMENT =
+  /^\s*["']?[\w.-]*version[\w.-]*["']?\s*[:=]\s*["'][^"']*["']\s*[,;]?\s*$/i
+const BARE_VERSION = /^\s*v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?\s*$/
+const MANIFEST_ENTRY = /^\s*"[^"]+"\s*:\s*"v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?"\s*,?\s*$/
+const RELEASE_ANNOTATION = /x-release-please-(?:version|major|minor|patch|start-\w+|end)/
+
+/**
+ * JSON keys that a configured `jsonpath` extra file is allowed to rewrite,
+ * beyond `version`. Keyed by repository-relative path.
+ * @param {Record<string, unknown>} config
+ * @returns {Map<string, Set<string>>}
+ */
+function extraFileJsonKeys(config) {
+  /** @type {Map<string, Set<string>>} */
+  const keys = new Map()
+  /** @param {unknown} entries @param {string} prefix */
+  const collect = (entries, prefix) => {
+    if (!Array.isArray(entries)) return
+    for (const entry of entries) {
+      if (!entry || typeof entry !== 'object' || typeof entry.path !== 'string') continue
+      if (typeof entry.jsonpath !== 'string') continue
+      const key = /(?:\.|\["|\['|\[)?([^.[\]"']+)(?:"\]|'\]|\])?$/.exec(entry.jsonpath)?.[1]
+      if (!key) continue
+      const clean = entry.path.replace(/^\.\//, '').replace(/\\/g, '/')
+      const path = prefix ? `${prefix}/${clean}` : clean
+      keys.set(path, (keys.get(path) ?? new Set()).add(key))
+    }
+  }
+  collect(config['extra-files'], '')
+  const packages = config.packages
+  if (packages && typeof packages === 'object' && !Array.isArray(packages)) {
+    for (const [directory, value] of Object.entries(packages)) {
+      if (value && typeof value === 'object' && !Array.isArray(value))
+        collect(value['extra-files'], directory === '.' ? '' : directory.replace(/\/$/, ''))
+    }
+  }
+  return keys
+}
+
+/**
+ * @param {{ removed: string[], added: string[] }} entry
+ * @param {Set<string>|undefined} extraKeys
+ * @returns {boolean}
+ */
+function sameJsonExceptVersions(entry, extraKeys) {
+  if (!entry.removed.length || entry.removed.length !== entry.added.length) return false
+  const ignored = new Set(['version', ...(extraKeys ?? [])])
+  /** @param {string} text */
+  const normalize = (text) => {
+    const parsed = JSON.parse(text)
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+      throw new Error('not an object')
+    for (const key of ignored) delete parsed[key]
+    return JSON.stringify(parsed)
+  }
+  try {
+    return entry.removed.every((line, index) => normalize(line) === normalize(entry.added[index]))
+  } catch {
+    return false
+  }
+}
+
+/** @param {string[]} values @returns {string} */
+function summarize(values) {
+  if (!values.length) return 'none'
+  const more = values.length > 3 ? ` (+${values.length - 3} more)` : ''
+  return `${values.slice(0, 3).join(' | ')}${more}`
+}
+
+/** @param {string} line @returns {string} */
+function clip(line) {
+  const text = line.trim()
+  return text.length > 100 ? `${text.slice(0, 97)}...` : text
+}
+
+/**
+ * Decide whether one changed line is a legitimate Release Please mutation of
+ * `path`. Only version assignments, the manifest's package versions, and
+ * changelog additions qualify; any other line means the generator wrote
+ * content it did not read from the branch it is releasing.
+ * @param {string} path @param {'-'|'+'} side @param {string} line
+ * @param {Map<string, Set<string>>} extraKeys
+ */
+function isReleaseMutation(path, side, line, extraKeys) {
+  const name = path.split('/').pop() ?? path
+  if (name === '.release-please-manifest.json')
+    return MANIFEST_ENTRY.test(line) || /^\s*[{}]\s*$/.test(line)
+  if (/^CHANGELOG(?:\.\w+)?$/i.test(name)) return side === '+'
+  if (VERSION_ASSIGNMENT.test(line) || BARE_VERSION.test(line) || RELEASE_ANNOTATION.test(line))
+    return true
+  for (const key of extraKeys.get(path) ?? []) {
+    const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+    if (new RegExp(`^\\s*"${escaped}"\\s*:\\s*"[^"]*"\\s*,?\\s*$`).test(line)) return true
+  }
+  return false
+}
+
+/**
+ * Audit the content of a generated release diff. The path audit only proves
+ * that approved files changed; a Release Please run that straddles a push to
+ * main can write the release commit with file bodies read before that push,
+ * silently reverting the merged change inside an approved file (for example a
+ * dependency range in package.json). Every added or removed line must be a
+ * release mutation, so a reverted range, script or dependency fails closed.
+ * @param {string} patch Unified diff of the release PR against its base.
+ * @param {{ config?: Record<string, unknown> }} [options]
+ * @returns {string[]}
+ */
+export function auditReleaseDiffContent(patch, options = {}) {
+  const extraKeys = extraFileJsonKeys(options.config ?? {})
+  /** @type {string[]} */
+  const errors = []
+  /** @type {Map<string, { removed: string[], added: string[] }>} */
+  const foreign = new Map()
+  const lines = String(patch).split(/\r?\n/)
+  let oldPath = ''
+  let path = ''
+  let inHunk = false
+  let removedLeft = 0
+  let addedLeft = 0
+  for (const line of lines) {
+    if (inHunk && (removedLeft > 0 || addedLeft > 0)) {
+      if (line.startsWith('\\')) continue
+      if (line.startsWith('-') && removedLeft > 0) {
+        removedLeft -= 1
+        record(path, '-', line.slice(1))
+        continue
+      }
+      if (line.startsWith('+') && addedLeft > 0) {
+        addedLeft -= 1
+        record(path, '+', line.slice(1))
+        continue
+      }
+      if (line.startsWith(' ')) {
+        // -U0 emits no context; tolerate it when a caller passes a wider diff.
+        if (removedLeft > 0) removedLeft -= 1
+        if (addedLeft > 0) addedLeft -= 1
+        continue
+      }
+    }
+    if (line.startsWith('diff --git ')) {
+      inHunk = false
+      oldPath = ''
+      path = /^diff --git a\/.* b\/(.*)$/.exec(line)?.[1] ?? ''
+    } else if (line.startsWith('--- ')) {
+      oldPath = line.slice(4).replace(/^a\//, '')
+    } else if (line.startsWith('+++ ')) {
+      const next = line.slice(4)
+      path = next === '/dev/null' ? oldPath : next.replace(/^b\//, '')
+    } else if (line.startsWith('deleted file mode')) {
+      errors.push(`Generated release diff deletes ${path || oldPath || 'a file'}.`)
+    } else if (line.startsWith('rename from ')) {
+      errors.push(`Generated release diff renames ${line.slice('rename from '.length)}.`)
+    } else if (line.startsWith('@@')) {
+      const match = /^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(line)
+      inHunk = Boolean(match)
+      removedLeft = match ? Number(match[1] ?? 1) : 0
+      addedLeft = match ? Number(match[2] ?? 1) : 0
+    }
+  }
+  /** @param {string} file @param {'-'|'+'} side @param {string} text */
+  function record(file, side, text) {
+    if (isReleaseMutation(file, side, text, extraKeys)) return
+    const entry = foreign.get(file) ?? { removed: [], added: [] }
+    entry[side === '-' ? 'removed' : 'added'].push(text)
+    foreign.set(file, entry)
+  }
+  for (const [file, entry] of foreign) {
+    // A minified manifest holds the whole document on one line, so its version
+    // bump cannot be isolated by line. Accept it when only version keys differ.
+    if (sameJsonExceptVersions(entry, extraKeys.get(file))) continue
+    entry.removed = entry.removed.map(clip)
+    entry.added = entry.added.map(clip)
+    errors.push(
+      `Generated release PR changes ${file} beyond release metadata (stale or foreign content). Removed: ${summarize(entry.removed)}. Added: ${summarize(entry.added)}.`
+    )
+  }
+  return errors
+}
+
 /** Files that must change for a generated release PR to count as a version bump. */
 const VERSION_METADATA_FILES = new Set([
   '.release-please-manifest.json',
@@ -223,7 +404,7 @@ const VERSION_METADATA_FILES = new Set([
  * must carry the exact approved Release Please prefix, come from the same
  * repository, change at least one path, change no unexpected paths, and bump
  * at least one version-metadata file (or a declared extra file).
- * @param {{ headRef?: string, headRepo?: string, repository?: string, changedPaths?: string[], config?: Record<string, unknown>, root?: string }} input
+ * @param {{ headRef?: string, headRepo?: string, repository?: string, changedPaths?: string[], config?: Record<string, unknown>, root?: string, patch?: string|null }} input
  * @returns {{ valid: boolean, errors: string[], changedPaths: string[] }}
  */
 export function validateGeneratedReleaseDiff(input) {
@@ -234,6 +415,7 @@ export function validateGeneratedReleaseDiff(input) {
     changedPaths = [],
     config = {},
     root = process.cwd(),
+    patch,
   } = input
   /** @type {string[]} */
   const errors = []
@@ -271,6 +453,13 @@ export function validateGeneratedReleaseDiff(input) {
     errors.push('Generated release pull request changes no version metadata.')
   }
   errors.push(...validateCargoLockVersions(root, config))
+  // Callers that can read the unified diff opt into the content audit. A null
+  // patch means the diff was requested but unreadable, which must not pass.
+  if (typeof patch === 'string') errors.push(...auditReleaseDiffContent(patch, { config }))
+  else if (patch === null)
+    errors.push(
+      'Unable to read the release content diff; refusing to pass an unaudited release PR.'
+    )
   return { valid: errors.length === 0, errors, changedPaths: paths }
 }
 

package/src/runtime-core.mjs

@@ -395,6 +395,15 @@ function validation(task) {
     const changedPaths = baseSha
       ? capture('git', ['diff', '--name-only', `${baseSha}...HEAD`]).split(/\r?\n/)
       : []
+    // The content audit needs the real diff. An unreadable diff must fail the
+    // gate, not pass as an empty patch.
+    const diff = baseSha
+      ? spawnSync(
+          'git',
+          ['diff', '--no-color', '--no-ext-diff', '--no-renames', '-U0', `${baseSha}...HEAD`],
+          { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }
+        )
+      : undefined
     const result = validateGeneratedReleaseDiff({
       headRef: process.env.FOUNDRY_HEAD_REF ?? '',
       headRepo: process.env.FOUNDRY_HEAD_REPO ?? '',
@@ -402,6 +411,7 @@ function validation(task) {
       changedPaths,
       config: readReleaseConfig(root),
       root,
+      patch: diff ? (diff.status === 0 ? diff.stdout : null) : undefined,
     })
     if (!result.valid) {
       for (const error of result.errors) console.error(`::error::${error}`)