code-foundry 1.48.5 → 1.48.7

package/.github/workflows/release.yml

@@ -439,6 +439,53 @@ jobs:
           latest=false
           if [ "$PRERELEASE" != true ]; then latest=true; fi
           gh release edit "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --draft=false --prerelease="$PRERELEASE" --latest="$latest"
+      - name: Sync lockfile workspace versions on generated release PRs
+        # Release Please bumps every workspace package.json but has no updater
+        # for bun.lock, which records each workspace's version, so a generated
+        # release PR leaves the lock naming the previous version of every
+        # workspace. Commit the corrected lock onto the release branch before
+        # the draft-state and merge steps read its head. The commit is made with
+        # the validated automation token so the PR's required checks run on it;
+        # a push made with the workflow token starts no workflows, so that
+        # credential skips this step and the release gate reports the stale
+        # lock instead. A rejected push (Release Please moved the branch) is
+        # not retried: the next release run starts again from the new head.
+        if: steps.release.outcome == 'success' && steps.credentials.outputs.token_source == 'configured'
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          mapfile -t release_branches < <(
+            gh pr list \
+              --repo "$GITHUB_REPOSITORY" \
+              --state open \
+              --base main \
+              --json headRefName \
+              --jq '.[] | select(.headRefName == "release-please--branches--main" or (.headRefName | startswith("release-please--branches--main--"))) | .headRefName'
+          )
+          if [ ${#release_branches[@]} -eq 0 ]; then
+            exit 0
+          fi
+          gh auth setup-git
+          index=0
+          for branch in "${release_branches[@]}"; do
+            index=$((index + 1))
+            worktree="$RUNNER_TEMP/release-lock-$index"
+            git fetch --no-tags --depth=1 origin "refs/heads/$branch"
+            git worktree add --detach "$worktree" FETCH_HEAD
+            node "$RUNNER_TEMP/code-foundry/src/cli.mjs" release sync-lock --target "$worktree"
+            if git -C "$worktree" diff --quiet -- bun.lock; then
+              continue
+            fi
+            git -C "$worktree" \
+              -c user.name='github-actions[bot]' \
+              -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \
+              commit --quiet -m 'chore(release): sync bun.lock workspace versions' -- bun.lock
+            if ! git -C "$worktree" push origin "HEAD:refs/heads/$branch"; then
+              echo "::warning title=Release lock sync::$branch moved before the lockfile sync could be pushed; the next release run will sync it."
+            fi
+          done
       - name: Normalize generated release PR draft state
         if: steps.release.outcome == 'success'
         env:

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.48.7](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.6...v1.48.7) (2026-10-23)
+
+
+### Bug Fixes
+
+* **release:** sync bun.lock workspace versions on generated release PRs ([#777](https://github.com/0xPlayerOne/code-foundry/issues/777)) ([b24bfae](https://github.com/0xPlayerOne/code-foundry/commit/b24bfae309ac7003fcc4cd57f79ddc418c27b039))
+
+## [1.48.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.5...v1.48.6) (2026-10-23)
+
+
+### Bug Fixes
+
+* **release:** audit generated release content for stale snapshots ([#775](https://github.com/0xPlayerOne/code-foundry/issues/775)) ([f842c27](https://github.com/0xPlayerOne/code-foundry/commit/f842c271e6b270b63a6d9b839795a849237c7a7d))
+
 ## [1.48.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.4...v1.48.5) (2026-10-22)
 
 
@@ -126,23 +140,9 @@
 
 * **qualification:** skip parallel-syntax files until actionlint supports them ([#740](https://github.com/0xPlayerOne/code-foundry/issues/740)) ([db98c7f](https://github.com/0xPlayerOne/code-foundry/commit/db98c7f40cae080cdc9dcab7baac4976e5e0656e))
 
-## [1.46.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.45.2...v1.46.0) (2026-10-07)
-
-
-### Features
-
-* **billing:** run fast-lane executes concurrently ([#738](https://github.com/0xPlayerOne/code-foundry/issues/738)) ([b40e82a](https://github.com/0xPlayerOne/code-foundry/commit/b40e82a0709b288a8be46998cfdc8b909f92c23c))
-
-## [1.45.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.45.1...v1.45.2) (2026-10-06)
-
-
-### Bug Fixes
-
-* **billing:** emit the codeql input as a YAML boolean ([#735](https://github.com/0xPlayerOne/code-foundry/issues/735)) ([e0b348c](https://github.com/0xPlayerOne/code-foundry/commit/e0b348c9a3c730e46210fe0b9dc46af49c9db605))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 253 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 255 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/RELEASES.md

@@ -108,6 +108,56 @@ and sync never overwrites existing manifest versions. Legacy configs without
 manifest; `code-foundry doctor` fails when a manifest-mode config is missing
 its manifest.
 
+## Generated release content audit
+
+Release Please writes the release commit from file bodies it reads over the
+GitHub API. A run that starts on one push and finishes after another can commit
+bodies read before the second push onto the newer `main`, so the version PR
+silently reverts the merged change inside an approved file (agent-sim #133
+reverted `@adea-ai/ui` from `^0.144.0` to `^0.143.0` in six `package.json`
+files). A path audit cannot see this, because every changed path is an approved
+release file.
+
+Both release checks therefore read the unified diff against the base and require
+every added or removed line to be a release mutation: a version assignment
+(`"version": "1.2.3"`, `version = "1.2.3"`, a bare version file, a line carrying
+an `x-release-please-*` annotation, or a `jsonpath` key declared in
+`extra-files`), a `.release-please-manifest.json` package version, or an addition
+to a changelog. Any other change, a deleted file, or a rename fails closed and
+names the file and the first offending lines. A minified single-line JSON
+manifest passes when only its version keys differ. An unreadable diff also
+fails; it is never treated as empty.
+
+- `validation release_diff` (the required release-tier gate) audits
+  `base...HEAD` of the pull request merge commit, so a branch that is behind
+  `main` is judged by what merging it would do.
+- `release validate-prs` audits `gh pr diff` before auto-merge is requested.
+
+A failed audit leaves the version PR unmerged. Re-run the Release workflow
+(`workflow_dispatch`) so Release Please regenerates the branch from the current
+`main`; do not edit the generated branch or release manually.
+
+## Lockfile workspace versions
+
+Release Please's Node updater bumps every workspace `package.json` but has no
+updater for `bun.lock`, which records each workspace's `version`. A version PR
+therefore leaves the lock naming the previous version of every workspace (the
+agent-sim 0.15.14 release left all 14 workspaces at 0.15.10).
+
+- `validation release_diff` fails a generated release whose `bun.lock` records a
+  workspace version that differs from its `package.json`, and names the first
+  workspaces and the fix.
+- `code-foundry release sync-lock [--target PATH] [--dry-run]` rewrites only
+  those drifted `version` values; it never touches dependencies, the `packages`
+  section or line endings, and does nothing when the lock already matches.
+- The Release workflow runs it on each open generated release branch before the
+  draft-state and merge steps read the PR head, then pushes one
+  `chore(release): sync bun.lock workspace versions` commit with the validated
+  automation token so the required checks run on it. With the fallback workflow
+  token (whose pushes start no workflows) the step is skipped and the gate
+  reports the stale lock instead. A push rejected because Release Please moved
+  the branch is left for the next run.
+
 ## Pull request permissions
 
 The release job validates the configured automation token

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.48.5",
+  "version": "1.48.7",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/cli.mjs

@@ -23,6 +23,7 @@ Usage:
   npx code-foundry ci pause|resume|status [--target PATH]
   npx code-foundry release reconcile [--github] [--base BRANCH] [--head BRANCH]
   npx code-foundry release hook --tag TAG --workflow WORKFLOW
+  npx code-foundry release sync-lock [--target PATH] [--dry-run]
   npx code-foundry release-integrity settings --repo OWNER/REPO
   npx code-foundry release-integrity release --repo OWNER/REPO --tag TAG
   npx code-foundry release-integrity manifest --asset PATH [--root PATH]
@@ -93,9 +94,9 @@ function parseArgs(argv) {
 
   if (command === 'release') {
     const subcommand = argv.shift() ?? ''
-    if (!['reconcile', 'hook', 'validate-prs', 'recovery-plan'].includes(subcommand))
+    if (!['reconcile', 'hook', 'validate-prs', 'recovery-plan', 'sync-lock'].includes(subcommand))
       fail(
-        `unknown release command: ${subcommand ?? '(missing)'}; use release reconcile, release hook, release validate-prs, or release recovery-plan`
+        `unknown release command: ${subcommand ?? '(missing)'}; use release reconcile, release hook, release validate-prs, release recovery-plan, or release sync-lock`
       )
     options.releaseSubcommand = subcommand
   } else if (command === 'release-integrity') {
@@ -247,11 +248,13 @@ async function main() {
         dispatchPostReleaseHook,
         reconcileRelease,
         releaseRecoveryPlan,
+        syncReleaseLock,
         validateReleasePullRequestDiffs,
       } = await import('./commands/release.mjs')
       if (options.releaseSubcommand === 'hook') dispatchPostReleaseHook(target, options)
       else if (options.releaseSubcommand === 'validate-prs') validateReleasePullRequestDiffs(target)
       else if (options.releaseSubcommand === 'recovery-plan') releaseRecoveryPlan(target)
+      else if (options.releaseSubcommand === 'sync-lock') syncReleaseLock(target, options)
       else reconcileRelease(target, options)
     } catch (error) {
       fail(error instanceof Error ? error.message : String(error))

package/src/commands/release.mjs

@@ -7,6 +7,7 @@ import { spawnSync } from 'node:child_process'
 import {
   approvedReleaseFiles,
   buildReleaseRecoveryPlan,
+  auditReleaseDiffContent,
   buildReconciliationPullRequestBody,
   classifyReconciliation,
   readReleaseConfig,
@@ -16,6 +17,7 @@ import {
   selectReconciliationPullRequest,
   validateReleasePullRequests,
 } from '../lib/release-policy.mjs'
+import { syncBunLockWorkspaceVersions } from '../lib/bun-lock.mjs'
 import { hasDeliveredHook, releaseDeliveryKey, selectHookDelivery } from '../lib/release-hook.mjs'
 
 /** @typedef {{ target: string, dryRun: boolean, github: boolean, base: string, head: string }} ReleaseOptions */
@@ -767,6 +769,27 @@ export function dispatchPostReleaseHook(root, options) {
   return { ...decision, deliveryKey: key, dispatched: true }
 }
 
+/**
+ * Rewrite the workspace versions `bun.lock` records to match the manifests a
+ * Release Please run just bumped.
+ * @param {string} root
+ * @param {{ dryRun: boolean }} options
+ */
+export function syncReleaseLock(root, options) {
+  const changes = syncBunLockWorkspaceVersions(root, { dryRun: options.dryRun })
+  if (!changes.length) {
+    console.log('bun.lock workspace versions already match package.json; nothing to sync.')
+    return changes
+  }
+  const verb = options.dryRun ? 'Would update' : 'Updated'
+  for (const change of changes) {
+    console.log(
+      `${verb} bun.lock ${change.path || '.'} (${change.name}): ${change.from} -> ${change.to}`
+    )
+  }
+  return changes
+}
+
 /** @param {string} root */
 export function validateReleasePullRequestDiffs(root) {
   const repository = process.env.GITHUB_REPOSITORY
@@ -794,6 +817,8 @@ export function validateReleasePullRequestDiffs(root) {
   const paths = new Map()
   /** @type {string[]} */
   const headErrors = []
+  /** @type {string[]} */
+  const contentErrors = []
   for (const pr of generated) {
     const number = Number(pr.number)
     const result = spawnSync(
@@ -803,6 +828,25 @@ export function validateReleasePullRequestDiffs(root) {
     )
     paths.set(number, result.status === 0 ? result.stdout.split(/\r?\n/).filter(Boolean) : [])
 
+    // Paths prove only which files changed. Audit the content too, so a release
+    // generated from a stale snapshot cannot revert merged changes inside an
+    // approved file and still be queued for merge.
+    const content = spawnSync(
+      'gh',
+      ['pr', 'diff', String(number), '--repo', repository, '--color', 'never'],
+      { cwd: resolve(root), encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }
+    )
+    if (content.status === 0) {
+      for (const error of auditReleaseDiffContent(content.stdout, {
+        config: readReleaseConfig(root),
+      }))
+        contentErrors.push(`Generated release PR #${number}: ${error}`)
+    } else {
+      contentErrors.push(
+        `Generated release PR #${number}: unable to read its content diff; refusing to pass an unaudited release PR.`
+      )
+    }
+
     const auditedHead = typeof pr.headRefOid === 'string' ? pr.headRefOid : ''
     const currentPr = ghJson(root, [
       'pr',
@@ -828,9 +872,9 @@ export function validateReleasePullRequestDiffs(root) {
     paths,
     approvedReleaseFiles(readReleaseConfig(root))
   )
-  if (headErrors.length) {
+  if (headErrors.length || contentErrors.length) {
     validation.valid = false
-    validation.errors.push(...headErrors)
+    validation.errors.push(...headErrors, ...contentErrors)
   }
   console.log(JSON.stringify(validation, null, 2))
   if (!validation.valid) throw new Error(validation.errors.join(' '))

package/src/lib/bun-lock.mjs

@@ -0,0 +1,149 @@
+// @ts-check
+
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+/**
+ * Release Please's Node updater bumps every workspace `package.json` but has no
+ * updater for `bun.lock`, which records each workspace's version. A release
+ * commit therefore leaves the lock naming the previous version of every
+ * workspace. These helpers read and rewrite only those recorded versions; the
+ * rest of the lock is never touched.
+ */
+
+const WORKSPACES_START = /^ {2}"workspaces": \{\s*$/
+const WORKSPACES_END = /^ {2}\},?\s*$/
+const ENTRY_START = /^ {4}"([^"]*)": \{\s*$/
+const ENTRY_END = /^ {4}\},?\s*$/
+const NAME_LINE = /^ {6}"name": "([^"]*)",?\s*$/
+const VERSION_LINE = /^( {6}"version": ")([^"]*)(".*)$/
+
+/**
+ * @typedef {{ path: string, name: string, version: string, line: number }} LockedWorkspace
+ */
+
+/**
+ * The workspace versions a `bun.lock` records, with the line each sits on.
+ * Workspaces without a `version` line (the root, private packages without a
+ * version) are not listed: bun omits the key when the manifest has none.
+ * @param {string} text
+ * @returns {LockedWorkspace[]}
+ */
+export function lockedWorkspaces(text) {
+  const lines = text.split(/\r?\n/)
+  /** @type {LockedWorkspace[]} */
+  const found = []
+  let inWorkspaces = false
+  let entry = ''
+  let name = ''
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index]
+    if (!inWorkspaces) {
+      if (WORKSPACES_START.test(line)) inWorkspaces = true
+      continue
+    }
+    if (!entry) {
+      if (WORKSPACES_END.test(line)) break
+      const start = ENTRY_START.exec(line)
+      if (start) {
+        entry = start[1]
+        name = ''
+      }
+      continue
+    }
+    if (ENTRY_END.test(line)) {
+      entry = ''
+      continue
+    }
+    const nameLine = NAME_LINE.exec(line)
+    if (nameLine) {
+      name = nameLine[1]
+      continue
+    }
+    const versionLine = VERSION_LINE.exec(line)
+    if (versionLine) found.push({ path: entry, name, version: versionLine[2], line: index })
+  }
+  return found
+}
+
+/**
+ * @param {string} root
+ * @param {string} workspacePath
+ * @returns {string | undefined}
+ */
+function manifestVersion(root, workspacePath) {
+  const file = join(root, workspacePath, 'package.json')
+  if (!existsSync(file)) return undefined
+  try {
+    const version = JSON.parse(readFileSync(file, 'utf8')).version
+    return typeof version === 'string' && version ? version : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Locked workspace versions that differ from their manifest.
+ * @param {string} root
+ * @returns {Array<LockedWorkspace & { manifest: string }>}
+ */
+export function bunLockVersionDrift(root) {
+  const lockPath = join(root, 'bun.lock')
+  if (!existsSync(lockPath)) return []
+  /** @type {Array<LockedWorkspace & { manifest: string }>} */
+  const drift = []
+  for (const workspace of lockedWorkspaces(readFileSync(lockPath, 'utf8'))) {
+    const manifest = manifestVersion(root, workspace.path)
+    if (manifest !== undefined && manifest !== workspace.version)
+      drift.push({ ...workspace, manifest })
+  }
+  return drift
+}
+
+/**
+ * Release-gate errors for a stale `bun.lock`.
+ * @param {string} root
+ * @returns {string[]}
+ */
+export function validateBunLockVersions(root) {
+  const drift = bunLockVersionDrift(root)
+  if (!drift.length) return []
+  const shown = drift
+    .slice(0, 3)
+    .map(
+      (entry) =>
+        `${entry.path || '.'} (${entry.name || 'unnamed'}) is ${entry.version} in bun.lock but ${entry.manifest} in package.json`
+    )
+  const more = drift.length > shown.length ? ` (+${drift.length - shown.length} more)` : ''
+  return [
+    `bun.lock records ${drift.length} workspace version(s) that differ from package.json: ${shown.join('; ')}${more}. Run code-foundry release sync-lock.`,
+  ]
+}
+
+/**
+ * Rewrite stale workspace versions in `bun.lock` to match their manifests.
+ * Only the `version` value of a drifted workspace changes.
+ * @param {string} root
+ * @param {{ dryRun?: boolean }} [options]
+ * @returns {Array<{ path: string, name: string, from: string, to: string }>}
+ */
+export function syncBunLockWorkspaceVersions(root, options = {}) {
+  const drift = bunLockVersionDrift(root)
+  if (!drift.length) return []
+  const lockPath = join(root, 'bun.lock')
+  const text = readFileSync(lockPath, 'utf8')
+  const newline = text.includes('\r\n') ? '\r\n' : '\n'
+  const lines = text.split(/\r?\n/)
+  for (const entry of drift) {
+    const match = VERSION_LINE.exec(lines[entry.line])
+    if (!match) continue
+    lines[entry.line] = `${match[1]}${entry.manifest}${match[3]}`
+  }
+  if (!options.dryRun) writeFileSync(lockPath, lines.join(newline))
+  return drift.map((entry) => ({
+    path: entry.path,
+    name: entry.name,
+    from: entry.version,
+    to: entry.manifest,
+  }))
+}

package/src/lib/release-policy.mjs

@@ -2,6 +2,7 @@
 
 import { existsSync, readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
+import { validateBunLockVersions } from './bun-lock.mjs'
 import { isReleasePleaseHead } from './validation-policy.mjs'
 
 const DEFAULT_RELEASE_FILES = new Set([
@@ -209,6 +210,187 @@ export function validateReleasePullRequests(prs, changedPathsByPr, allowed) {
   return { valid: errors.length === 0, generated, errors }
 }
 
+/** A `key = value` or `"key": value` assignment whose key names a version. */
+const VERSION_ASSIGNMENT =
+  /^\s*["']?[\w.-]*version[\w.-]*["']?\s*[:=]\s*["'][^"']*["']\s*[,;]?\s*$/i
+const BARE_VERSION = /^\s*v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?\s*$/
+const MANIFEST_ENTRY = /^\s*"[^"]+"\s*:\s*"v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?"\s*,?\s*$/
+const RELEASE_ANNOTATION = /x-release-please-(?:version|major|minor|patch|start-\w+|end)/
+
+/**
+ * JSON keys that a configured `jsonpath` extra file is allowed to rewrite,
+ * beyond `version`. Keyed by repository-relative path.
+ * @param {Record<string, unknown>} config
+ * @returns {Map<string, Set<string>>}
+ */
+function extraFileJsonKeys(config) {
+  /** @type {Map<string, Set<string>>} */
+  const keys = new Map()
+  /** @param {unknown} entries @param {string} prefix */
+  const collect = (entries, prefix) => {
+    if (!Array.isArray(entries)) return
+    for (const entry of entries) {
+      if (!entry || typeof entry !== 'object' || typeof entry.path !== 'string') continue
+      if (typeof entry.jsonpath !== 'string') continue
+      const key = /(?:\.|\["|\['|\[)?([^.[\]"']+)(?:"\]|'\]|\])?$/.exec(entry.jsonpath)?.[1]
+      if (!key) continue
+      const clean = entry.path.replace(/^\.\//, '').replace(/\\/g, '/')
+      const path = prefix ? `${prefix}/${clean}` : clean
+      keys.set(path, (keys.get(path) ?? new Set()).add(key))
+    }
+  }
+  collect(config['extra-files'], '')
+  const packages = config.packages
+  if (packages && typeof packages === 'object' && !Array.isArray(packages)) {
+    for (const [directory, value] of Object.entries(packages)) {
+      if (value && typeof value === 'object' && !Array.isArray(value))
+        collect(value['extra-files'], directory === '.' ? '' : directory.replace(/\/$/, ''))
+    }
+  }
+  return keys
+}
+
+/**
+ * @param {{ removed: string[], added: string[] }} entry
+ * @param {Set<string>|undefined} extraKeys
+ * @returns {boolean}
+ */
+function sameJsonExceptVersions(entry, extraKeys) {
+  if (!entry.removed.length || entry.removed.length !== entry.added.length) return false
+  const ignored = new Set(['version', ...(extraKeys ?? [])])
+  /** @param {string} text */
+  const normalize = (text) => {
+    const parsed = JSON.parse(text)
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+      throw new Error('not an object')
+    for (const key of ignored) delete parsed[key]
+    return JSON.stringify(parsed)
+  }
+  try {
+    return entry.removed.every((line, index) => normalize(line) === normalize(entry.added[index]))
+  } catch {
+    return false
+  }
+}
+
+/** @param {string[]} values @returns {string} */
+function summarize(values) {
+  if (!values.length) return 'none'
+  const more = values.length > 3 ? ` (+${values.length - 3} more)` : ''
+  return `${values.slice(0, 3).join(' | ')}${more}`
+}
+
+/** @param {string} line @returns {string} */
+function clip(line) {
+  const text = line.trim()
+  return text.length > 100 ? `${text.slice(0, 97)}...` : text
+}
+
+/**
+ * Decide whether one changed line is a legitimate Release Please mutation of
+ * `path`. Only version assignments, the manifest's package versions, and
+ * changelog additions qualify; any other line means the generator wrote
+ * content it did not read from the branch it is releasing.
+ * @param {string} path @param {'-'|'+'} side @param {string} line
+ * @param {Map<string, Set<string>>} extraKeys
+ */
+function isReleaseMutation(path, side, line, extraKeys) {
+  const name = path.split('/').pop() ?? path
+  if (name === '.release-please-manifest.json')
+    return MANIFEST_ENTRY.test(line) || /^\s*[{}]\s*$/.test(line)
+  if (/^CHANGELOG(?:\.\w+)?$/i.test(name)) return side === '+'
+  if (VERSION_ASSIGNMENT.test(line) || BARE_VERSION.test(line) || RELEASE_ANNOTATION.test(line))
+    return true
+  for (const key of extraKeys.get(path) ?? []) {
+    const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+    if (new RegExp(`^\\s*"${escaped}"\\s*:\\s*"[^"]*"\\s*,?\\s*$`).test(line)) return true
+  }
+  return false
+}
+
+/**
+ * Audit the content of a generated release diff. The path audit only proves
+ * that approved files changed; a Release Please run that straddles a push to
+ * main can write the release commit with file bodies read before that push,
+ * silently reverting the merged change inside an approved file (for example a
+ * dependency range in package.json). Every added or removed line must be a
+ * release mutation, so a reverted range, script or dependency fails closed.
+ * @param {string} patch Unified diff of the release PR against its base.
+ * @param {{ config?: Record<string, unknown> }} [options]
+ * @returns {string[]}
+ */
+export function auditReleaseDiffContent(patch, options = {}) {
+  const extraKeys = extraFileJsonKeys(options.config ?? {})
+  /** @type {string[]} */
+  const errors = []
+  /** @type {Map<string, { removed: string[], added: string[] }>} */
+  const foreign = new Map()
+  const lines = String(patch).split(/\r?\n/)
+  let oldPath = ''
+  let path = ''
+  let inHunk = false
+  let removedLeft = 0
+  let addedLeft = 0
+  for (const line of lines) {
+    if (inHunk && (removedLeft > 0 || addedLeft > 0)) {
+      if (line.startsWith('\\')) continue
+      if (line.startsWith('-') && removedLeft > 0) {
+        removedLeft -= 1
+        record(path, '-', line.slice(1))
+        continue
+      }
+      if (line.startsWith('+') && addedLeft > 0) {
+        addedLeft -= 1
+        record(path, '+', line.slice(1))
+        continue
+      }
+      if (line.startsWith(' ')) {
+        // -U0 emits no context; tolerate it when a caller passes a wider diff.
+        if (removedLeft > 0) removedLeft -= 1
+        if (addedLeft > 0) addedLeft -= 1
+        continue
+      }
+    }
+    if (line.startsWith('diff --git ')) {
+      inHunk = false
+      oldPath = ''
+      path = /^diff --git a\/.* b\/(.*)$/.exec(line)?.[1] ?? ''
+    } else if (line.startsWith('--- ')) {
+      oldPath = line.slice(4).replace(/^a\//, '')
+    } else if (line.startsWith('+++ ')) {
+      const next = line.slice(4)
+      path = next === '/dev/null' ? oldPath : next.replace(/^b\//, '')
+    } else if (line.startsWith('deleted file mode')) {
+      errors.push(`Generated release diff deletes ${path || oldPath || 'a file'}.`)
+    } else if (line.startsWith('rename from ')) {
+      errors.push(`Generated release diff renames ${line.slice('rename from '.length)}.`)
+    } else if (line.startsWith('@@')) {
+      const match = /^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(line)
+      inHunk = Boolean(match)
+      removedLeft = match ? Number(match[1] ?? 1) : 0
+      addedLeft = match ? Number(match[2] ?? 1) : 0
+    }
+  }
+  /** @param {string} file @param {'-'|'+'} side @param {string} text */
+  function record(file, side, text) {
+    if (isReleaseMutation(file, side, text, extraKeys)) return
+    const entry = foreign.get(file) ?? { removed: [], added: [] }
+    entry[side === '-' ? 'removed' : 'added'].push(text)
+    foreign.set(file, entry)
+  }
+  for (const [file, entry] of foreign) {
+    // A minified manifest holds the whole document on one line, so its version
+    // bump cannot be isolated by line. Accept it when only version keys differ.
+    if (sameJsonExceptVersions(entry, extraKeys.get(file))) continue
+    entry.removed = entry.removed.map(clip)
+    entry.added = entry.added.map(clip)
+    errors.push(
+      `Generated release PR changes ${file} beyond release metadata (stale or foreign content). Removed: ${summarize(entry.removed)}. Added: ${summarize(entry.added)}.`
+    )
+  }
+  return errors
+}
+
 /** Files that must change for a generated release PR to count as a version bump. */
 const VERSION_METADATA_FILES = new Set([
   '.release-please-manifest.json',
@@ -223,7 +405,7 @@ const VERSION_METADATA_FILES = new Set([
  * must carry the exact approved Release Please prefix, come from the same
  * repository, change at least one path, change no unexpected paths, and bump
  * at least one version-metadata file (or a declared extra file).
- * @param {{ headRef?: string, headRepo?: string, repository?: string, changedPaths?: string[], config?: Record<string, unknown>, root?: string }} input
+ * @param {{ headRef?: string, headRepo?: string, repository?: string, changedPaths?: string[], config?: Record<string, unknown>, root?: string, patch?: string|null }} input
  * @returns {{ valid: boolean, errors: string[], changedPaths: string[] }}
  */
 export function validateGeneratedReleaseDiff(input) {
@@ -234,6 +416,7 @@ export function validateGeneratedReleaseDiff(input) {
     changedPaths = [],
     config = {},
     root = process.cwd(),
+    patch,
   } = input
   /** @type {string[]} */
   const errors = []
@@ -271,6 +454,14 @@ export function validateGeneratedReleaseDiff(input) {
     errors.push('Generated release pull request changes no version metadata.')
   }
   errors.push(...validateCargoLockVersions(root, config))
+  errors.push(...validateBunLockVersions(root))
+  // Callers that can read the unified diff opt into the content audit. A null
+  // patch means the diff was requested but unreadable, which must not pass.
+  if (typeof patch === 'string') errors.push(...auditReleaseDiffContent(patch, { config }))
+  else if (patch === null)
+    errors.push(
+      'Unable to read the release content diff; refusing to pass an unaudited release PR.'
+    )
   return { valid: errors.length === 0, errors, changedPaths: paths }
 }
 

package/src/runtime-core.mjs

@@ -395,6 +395,15 @@ function validation(task) {
     const changedPaths = baseSha
       ? capture('git', ['diff', '--name-only', `${baseSha}...HEAD`]).split(/\r?\n/)
       : []
+    // The content audit needs the real diff. An unreadable diff must fail the
+    // gate, not pass as an empty patch.
+    const diff = baseSha
+      ? spawnSync(
+          'git',
+          ['diff', '--no-color', '--no-ext-diff', '--no-renames', '-U0', `${baseSha}...HEAD`],
+          { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }
+        )
+      : undefined
     const result = validateGeneratedReleaseDiff({
       headRef: process.env.FOUNDRY_HEAD_REF ?? '',
       headRepo: process.env.FOUNDRY_HEAD_REPO ?? '',
@@ -402,6 +411,7 @@ function validation(task) {
       changedPaths,
       config: readReleaseConfig(root),
       root,
+      patch: diff ? (diff.status === 0 ? diff.stdout : null) : undefined,
     })
     if (!result.valid) {
       for (const error of result.errors) console.error(`::error::${error}`)