code-foundry 1.48.6 → 1.48.8

package/.github/workflows/release.yml

@@ -439,6 +439,53 @@ jobs:
           latest=false
           if [ "$PRERELEASE" != true ]; then latest=true; fi
           gh release edit "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --draft=false --prerelease="$PRERELEASE" --latest="$latest"
+      - name: Sync lockfile workspace versions on generated release PRs
+        # Release Please bumps every workspace package.json but has no updater
+        # for bun.lock, which records each workspace's version, so a generated
+        # release PR leaves the lock naming the previous version of every
+        # workspace. Commit the corrected lock onto the release branch before
+        # the draft-state and merge steps read its head. The commit is made with
+        # the validated automation token so the PR's required checks run on it;
+        # a push made with the workflow token starts no workflows, so that
+        # credential skips this step and the release gate reports the stale
+        # lock instead. A rejected push (Release Please moved the branch) is
+        # not retried: the next release run starts again from the new head.
+        if: steps.release.outcome == 'success' && steps.credentials.outputs.token_source == 'configured'
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          mapfile -t release_branches < <(
+            gh pr list \
+              --repo "$GITHUB_REPOSITORY" \
+              --state open \
+              --base main \
+              --json headRefName \
+              --jq '.[] | select(.headRefName == "release-please--branches--main" or (.headRefName | startswith("release-please--branches--main--"))) | .headRefName'
+          )
+          if [ ${#release_branches[@]} -eq 0 ]; then
+            exit 0
+          fi
+          gh auth setup-git
+          index=0
+          for branch in "${release_branches[@]}"; do
+            index=$((index + 1))
+            worktree="$RUNNER_TEMP/release-lock-$index"
+            git fetch --no-tags --depth=1 origin "refs/heads/$branch"
+            git worktree add --detach "$worktree" FETCH_HEAD
+            node "$RUNNER_TEMP/code-foundry/src/cli.mjs" release sync-lock --target "$worktree"
+            if git -C "$worktree" diff --quiet -- bun.lock; then
+              continue
+            fi
+            git -C "$worktree" \
+              -c user.name='github-actions[bot]' \
+              -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \
+              commit --quiet -m 'chore(release): sync bun.lock workspace versions' -- bun.lock
+            if ! git -C "$worktree" push origin "HEAD:refs/heads/$branch"; then
+              echo "::warning title=Release lock sync::$branch moved before the lockfile sync could be pushed; the next release run will sync it."
+            fi
+          done
       - name: Normalize generated release PR draft state
         if: steps.release.outcome == 'success'
         env:
@@ -467,96 +514,106 @@ jobs:
           fi
 
           for pr in "${release_prs[@]}"; do
-            pr_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
-              --json isDraft,headRefOid,headRefName \
-              --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
-            read -r PR_DRAFT PR_HEAD PR_BRANCH <<< "$pr_state"
-            if [[ ! "$PR_DRAFT" =~ ^(true|false)$ || ! "$PR_HEAD" =~ ^[a-f0-9]{40}$ ]]; then
-              echo 'Unable to verify generated release PR state.' >&2
-              exit 1
-            fi
-            case "$PR_BRANCH" in
-              release-please--branches--main|release-please--branches--main--*) ;;
-              *) echo 'Release PR head left the generated namespace; refusing readiness mutation.' >&2; exit 1 ;;
-            esac
-            if [ "$AUTO_MERGE" = true ]; then
-              if [ "$PR_DRAFT" = false ]; then
-                # A ready head already receives synchronize validation. Preserve
-                # its live/completed owner instead of cancelling and reallocating
-                # CI every time another queued main release run prepares it.
-                runs=$(GH_TOKEN="$VALIDATION_TOKEN" gh api \
-                  "repos/$GITHUB_REPOSITORY/actions/runs" --method GET \
-                  -f event=pull_request -f head_sha="$PR_HEAD" -f per_page=100)
-                validation=$(jq -er --arg head "$PR_HEAD" --arg branch "$PR_BRANCH" \
-                  --arg repo "$GITHUB_REPOSITORY" '
-                  def active: .status == "queued" or .status == "in_progress" or
-                    .status == "waiting" or .status == "pending" or .status == "requested";
-                  def valid_run:
-                    type == "object" and
-                    (.id | type == "number" and . > 0 and floor == .) and
-                    (.run_attempt | type == "number" and . >= 1 and floor == .) and
-                    (.head_sha | type == "string" and test("^[a-f0-9]{40}$")) and
-                    (.head_branch | type == "string" and length > 0) and
-                    (.event | type == "string" and length > 0) and
-                    (.repository | type == "object") and
-                    (.repository.full_name | type == "string" and length > 0) and
-                    (.path | type == "string" and length > 0) and
-                    ((active and has("conclusion") and .conclusion == null) or
-                     (.status == "completed" and
-                      (.conclusion == "success" or .conclusion == "failure" or
-                       .conclusion == "timed_out" or .conclusion == "action_required" or
-                       .conclusion == "cancelled" or .conclusion == "skipped" or
-                       .conclusion == "neutral")));
-                  if (.workflow_runs | type) != "array" or
-                     (.total_count | type) != "number" then
-                    error("Invalid validation owner response")
-                  elif .total_count != (.workflow_runs | length) then
-                    error("Incomplete validation owner response")
-                  elif any(.workflow_runs[]; valid_run | not) then
-                    error("Invalid validation run identity or state")
-                  else
-                    [.workflow_runs[] | (.path | split("@")[0]) as $workflow | select(
-                      .head_sha == $head and .head_branch == $branch and
-                      .event == "pull_request" and .repository.full_name == $repo and
-                      ($workflow == ".github/workflows/validation.yml" or
-                       $workflow == ".github/workflows/validation_self-ci.yml")
-                    )] | sort_by(.id) | last |
-                    if . == null then "missing"
-                    elif active or (.status == "completed" and .conclusion == "success") then "owned"
-                    elif .status == "completed" and
-                         (.conclusion == "failure" or .conclusion == "timed_out" or
-                          .conclusion == "action_required") then "failed"
-                    elif .status == "completed" and
-                         (.conclusion == "cancelled" or .conclusion == "skipped" or
-                          .conclusion == "neutral") then "missing"
-                    else error("Unconfirmed validation owner state") end
-                  end' <<< "$runs")
-                fresh_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
-                  --json isDraft,headRefOid,headRefName \
-                  --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
-                if [ "$fresh_state" != "$pr_state" ]; then
-                  echo 'Release PR state changed during validation lookup; refusing a stale readiness mutation.' >&2
-                  exit 1
-                fi
-                if [ "$validation" = owned ]; then
-                  echo "Release PR #$pr already has current-head validation; preserving readiness."
-                  continue
+            # A lock-sync/synchronize transition can move the PR while Actions is
+            # being read. Re-evaluate the whole tuple and its owner; never carry
+            # eligibility across heads or retry a stable failed qualification.
+            for state_attempt in 1 2 3; do
+              pr_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
+                --json isDraft,headRefOid,headRefName \
+                --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
+              read -r PR_DRAFT PR_HEAD PR_BRANCH <<< "$pr_state"
+              if [[ ! "$PR_DRAFT" =~ ^(true|false)$ || ! "$PR_HEAD" =~ ^[a-f0-9]{40}$ ]]; then
+                echo 'Unable to verify generated release PR state.' >&2
+                exit 1
+              fi
+              case "$PR_BRANCH" in
+                release-please--branches--main|release-please--branches--main--*) ;;
+                *) echo 'Release PR head left the generated namespace; refusing readiness mutation.' >&2; exit 1 ;;
+              esac
+              if [ "$AUTO_MERGE" = true ]; then
+                if [ "$PR_DRAFT" = false ]; then
+                  # A ready head already receives synchronize validation. Preserve
+                  # its live/completed owner instead of cancelling and reallocating
+                  # CI every time another queued main release run prepares it.
+                  runs=$(GH_TOKEN="$VALIDATION_TOKEN" gh api \
+                    "repos/$GITHUB_REPOSITORY/actions/runs" --method GET \
+                    -f event=pull_request -f head_sha="$PR_HEAD" -f per_page=100)
+                  validation=$(jq -er --arg head "$PR_HEAD" --arg branch "$PR_BRANCH" \
+                    --arg repo "$GITHUB_REPOSITORY" '
+                    def active: .status == "queued" or .status == "in_progress" or
+                      .status == "waiting" or .status == "pending" or .status == "requested";
+                    def valid_run:
+                      type == "object" and
+                      (.id | type == "number" and . > 0 and floor == .) and
+                      (.run_attempt | type == "number" and . >= 1 and floor == .) and
+                      (.head_sha | type == "string" and test("^[a-f0-9]{40}$")) and
+                      (.head_branch | type == "string" and length > 0) and
+                      (.event | type == "string" and length > 0) and
+                      (.repository | type == "object") and
+                      (.repository.full_name | type == "string" and length > 0) and
+                      (.path | type == "string" and length > 0) and
+                      ((active and has("conclusion") and .conclusion == null) or
+                       (.status == "completed" and
+                        (.conclusion == "success" or .conclusion == "failure" or
+                         .conclusion == "timed_out" or .conclusion == "action_required" or
+                         .conclusion == "cancelled" or .conclusion == "skipped" or
+                         .conclusion == "neutral")));
+                    if (.workflow_runs | type) != "array" or
+                       (.total_count | type) != "number" then
+                      error("Invalid validation owner response")
+                    elif .total_count != (.workflow_runs | length) then
+                      error("Incomplete validation owner response")
+                    elif any(.workflow_runs[]; valid_run | not) then
+                      error("Invalid validation run identity or state")
+                    else
+                      [.workflow_runs[] | (.path | split("@")[0]) as $workflow | select(
+                        .head_sha == $head and .head_branch == $branch and
+                        .event == "pull_request" and .repository.full_name == $repo and
+                        ($workflow == ".github/workflows/validation.yml" or
+                         $workflow == ".github/workflows/validation_self-ci.yml")
+                      )] | sort_by(.id) | last |
+                      if . == null then "missing"
+                      elif active or (.status == "completed" and .conclusion == "success") then "owned"
+                      elif .status == "completed" and
+                           (.conclusion == "failure" or .conclusion == "timed_out" or
+                            .conclusion == "action_required") then "failed"
+                      elif .status == "completed" and
+                           (.conclusion == "cancelled" or .conclusion == "skipped" or
+                            .conclusion == "neutral") then "missing"
+                      else error("Unconfirmed validation owner state") end
+                    end' <<< "$runs")
+                  fresh_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
+                    --json isDraft,headRefOid,headRefName \
+                    --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
+                  if [ "$fresh_state" != "$pr_state" ]; then
+                    if [ "$state_attempt" -eq 3 ]; then
+                      echo 'Release PR state did not stabilize during validation lookup; refusing readiness mutation.' >&2
+                      exit 1
+                    fi
+                    echo "Release PR #$pr changed during validation lookup; reading its complete state and owner again."
+                    continue
+                  fi
+                  if [ "$validation" = owned ]; then
+                    echo "Release PR #$pr already has current-head validation; preserving readiness."
+                    break
+                  fi
+                  if [ "$validation" = failed ]; then
+                    echo "Current-head validation failed for release PR #$pr; resolve or explicitly retry it before release." >&2
+                    exit 1
+                  fi
+                  # A missing, cancelled or skipped owner still needs the existing
+                  # explicit ready_for_review transition with the validated token.
+                  gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
                 fi
-                if [ "$validation" = failed ]; then
-                  echo "Current-head validation failed for release PR #$pr; resolve or explicitly retry it before release." >&2
-                  exit 1
+                gh pr ready "$pr" --repo "$GITHUB_REPOSITORY"
+              else
+                if [ "$PR_DRAFT" = false ]; then
+                  gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
                 fi
-                # A missing, cancelled or skipped owner still needs the existing
-                # explicit ready_for_review transition with the validated token.
-                gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
-              fi
-              gh pr ready "$pr" --repo "$GITHUB_REPOSITORY"
-            else
-              if [ "$PR_DRAFT" = false ]; then
-                gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
+                echo "::notice title=Manual release merge required::Release Please created or updated a version pull request. No valid automation token is available (absent or rejected by GitHub), so release PRs are left in draft and need manual readiness before validation and merge workflows trigger."
               fi
-              echo "::notice title=Manual release merge required::Release Please created or updated a version pull request. No valid automation token is available (absent or rejected by GitHub), so release PRs are left in draft and need manual readiness before validation and merge workflows trigger."
-            fi
+              break
+            done
           done
       - name: Leave release pull request for manual merge
         if: steps.release.outputs.prs_created == 'true' && steps.credentials.outputs.auto_merge != 'true'

package/.github/workflows/validation-billing.yml

@@ -1161,8 +1161,8 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          # The content audit needs historical blobs after checkout removes credentials.
           fetch-depth: 0
-          filter: blob:none
       - name: Validate generated release diff
         if: ${{ inputs.mode == 'release' }}
         env:

package/.github/workflows/validation-no-codeql.yml

@@ -205,8 +205,8 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          # The content audit needs historical blobs after checkout removes credentials.
           fetch-depth: 0
-          filter: blob:none
       - name: Validate generated release diff
         if: ${{ inputs.mode == 'release' }}
         env:

package/.github/workflows/validation.yml

@@ -216,8 +216,8 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          # The content audit needs historical blobs after checkout removes credentials.
           fetch-depth: 0
-          filter: blob:none
       - name: Validate generated release diff
         if: ${{ inputs.mode == 'release' }}
         env:

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.48.8](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.7...v1.48.8) (2026-10-24)
+
+
+### Bug Fixes
+
+* **release:** hydrate audit blobs and refresh changing PR state ([#779](https://github.com/0xPlayerOne/code-foundry/issues/779)) ([8734ed7](https://github.com/0xPlayerOne/code-foundry/commit/8734ed77d159818cd5ff613f40a5dab796789d8a))
+
+## [1.48.7](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.6...v1.48.7) (2026-10-23)
+
+
+### Bug Fixes
+
+* **release:** sync bun.lock workspace versions on generated release PRs ([#777](https://github.com/0xPlayerOne/code-foundry/issues/777)) ([b24bfae](https://github.com/0xPlayerOne/code-foundry/commit/b24bfae309ac7003fcc4cd57f79ddc418c27b039))
+
 ## [1.48.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.5...v1.48.6) (2026-10-23)
 
 
@@ -126,23 +140,9 @@
 
 * **billing:** join fast-lane receipts in a second parallel group ([#742](https://github.com/0xPlayerOne/code-foundry/issues/742)) ([c63a39c](https://github.com/0xPlayerOne/code-foundry/commit/c63a39cf5e236d6747bd85cf10b04bd10f690b11))
 
-## [1.46.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.0...v1.46.1) (2026-10-07)
-
-
-### Bug Fixes
-
-* **qualification:** skip parallel-syntax files until actionlint supports them ([#740](https://github.com/0xPlayerOne/code-foundry/issues/740)) ([db98c7f](https://github.com/0xPlayerOne/code-foundry/commit/db98c7f40cae080cdc9dcab7baac4976e5e0656e))
-
-## [1.46.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.45.2...v1.46.0) (2026-10-07)
-
-
-### Features
-
-* **billing:** run fast-lane executes concurrently ([#738](https://github.com/0xPlayerOne/code-foundry/issues/738)) ([b40e82a](https://github.com/0xPlayerOne/code-foundry/commit/b40e82a0709b288a8be46998cfdc8b909f92c23c))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 254 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 256 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/RELEASES.md

@@ -137,6 +137,27 @@ A failed audit leaves the version PR unmerged. Re-run the Release workflow
 (`workflow_dispatch`) so Release Please regenerates the branch from the current
 `main`; do not edit the generated branch or release manually.
 
+## Lockfile workspace versions
+
+Release Please's Node updater bumps every workspace `package.json` but has no
+updater for `bun.lock`, which records each workspace's `version`. A version PR
+therefore leaves the lock naming the previous version of every workspace (the
+agent-sim 0.15.14 release left all 14 workspaces at 0.15.10).
+
+- `validation release_diff` fails a generated release whose `bun.lock` records a
+  workspace version that differs from its `package.json`, and names the first
+  workspaces and the fix.
+- `code-foundry release sync-lock [--target PATH] [--dry-run]` rewrites only
+  those drifted `version` values; it never touches dependencies, the `packages`
+  section or line endings, and does nothing when the lock already matches.
+- The Release workflow runs it on each open generated release branch before the
+  draft-state and merge steps read the PR head, then pushes one
+  `chore(release): sync bun.lock workspace versions` commit with the validated
+  automation token so the required checks run on it. With the fallback workflow
+  token (whose pushes start no workflows) the step is skipped and the gate
+  reports the stale lock instead. A push rejected because Release Please moved
+  the branch is left for the next run.
+
 ## Pull request permissions
 
 The release job validates the configured automation token

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.48.6",
+  "version": "1.48.8",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/cli.mjs

@@ -23,6 +23,7 @@ Usage:
   npx code-foundry ci pause|resume|status [--target PATH]
   npx code-foundry release reconcile [--github] [--base BRANCH] [--head BRANCH]
   npx code-foundry release hook --tag TAG --workflow WORKFLOW
+  npx code-foundry release sync-lock [--target PATH] [--dry-run]
   npx code-foundry release-integrity settings --repo OWNER/REPO
   npx code-foundry release-integrity release --repo OWNER/REPO --tag TAG
   npx code-foundry release-integrity manifest --asset PATH [--root PATH]
@@ -93,9 +94,9 @@ function parseArgs(argv) {
 
   if (command === 'release') {
     const subcommand = argv.shift() ?? ''
-    if (!['reconcile', 'hook', 'validate-prs', 'recovery-plan'].includes(subcommand))
+    if (!['reconcile', 'hook', 'validate-prs', 'recovery-plan', 'sync-lock'].includes(subcommand))
       fail(
-        `unknown release command: ${subcommand ?? '(missing)'}; use release reconcile, release hook, release validate-prs, or release recovery-plan`
+        `unknown release command: ${subcommand ?? '(missing)'}; use release reconcile, release hook, release validate-prs, release recovery-plan, or release sync-lock`
       )
     options.releaseSubcommand = subcommand
   } else if (command === 'release-integrity') {
@@ -247,11 +248,13 @@ async function main() {
         dispatchPostReleaseHook,
         reconcileRelease,
         releaseRecoveryPlan,
+        syncReleaseLock,
         validateReleasePullRequestDiffs,
       } = await import('./commands/release.mjs')
       if (options.releaseSubcommand === 'hook') dispatchPostReleaseHook(target, options)
       else if (options.releaseSubcommand === 'validate-prs') validateReleasePullRequestDiffs(target)
       else if (options.releaseSubcommand === 'recovery-plan') releaseRecoveryPlan(target)
+      else if (options.releaseSubcommand === 'sync-lock') syncReleaseLock(target, options)
       else reconcileRelease(target, options)
     } catch (error) {
       fail(error instanceof Error ? error.message : String(error))

package/src/commands/release.mjs

@@ -17,6 +17,7 @@ import {
   selectReconciliationPullRequest,
   validateReleasePullRequests,
 } from '../lib/release-policy.mjs'
+import { syncBunLockWorkspaceVersions } from '../lib/bun-lock.mjs'
 import { hasDeliveredHook, releaseDeliveryKey, selectHookDelivery } from '../lib/release-hook.mjs'
 
 /** @typedef {{ target: string, dryRun: boolean, github: boolean, base: string, head: string }} ReleaseOptions */
@@ -768,6 +769,27 @@ export function dispatchPostReleaseHook(root, options) {
   return { ...decision, deliveryKey: key, dispatched: true }
 }
 
+/**
+ * Rewrite the workspace versions `bun.lock` records to match the manifests a
+ * Release Please run just bumped.
+ * @param {string} root
+ * @param {{ dryRun: boolean }} options
+ */
+export function syncReleaseLock(root, options) {
+  const changes = syncBunLockWorkspaceVersions(root, { dryRun: options.dryRun })
+  if (!changes.length) {
+    console.log('bun.lock workspace versions already match package.json; nothing to sync.')
+    return changes
+  }
+  const verb = options.dryRun ? 'Would update' : 'Updated'
+  for (const change of changes) {
+    console.log(
+      `${verb} bun.lock ${change.path || '.'} (${change.name}): ${change.from} -> ${change.to}`
+    )
+  }
+  return changes
+}
+
 /** @param {string} root */
 export function validateReleasePullRequestDiffs(root) {
   const repository = process.env.GITHUB_REPOSITORY

package/src/lib/bun-lock.mjs

@@ -0,0 +1,149 @@
+// @ts-check
+
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+/**
+ * Release Please's Node updater bumps every workspace `package.json` but has no
+ * updater for `bun.lock`, which records each workspace's version. A release
+ * commit therefore leaves the lock naming the previous version of every
+ * workspace. These helpers read and rewrite only those recorded versions; the
+ * rest of the lock is never touched.
+ */
+
+const WORKSPACES_START = /^ {2}"workspaces": \{\s*$/
+const WORKSPACES_END = /^ {2}\},?\s*$/
+const ENTRY_START = /^ {4}"([^"]*)": \{\s*$/
+const ENTRY_END = /^ {4}\},?\s*$/
+const NAME_LINE = /^ {6}"name": "([^"]*)",?\s*$/
+const VERSION_LINE = /^( {6}"version": ")([^"]*)(".*)$/
+
+/**
+ * @typedef {{ path: string, name: string, version: string, line: number }} LockedWorkspace
+ */
+
+/**
+ * The workspace versions a `bun.lock` records, with the line each sits on.
+ * Workspaces without a `version` line (the root, private packages without a
+ * version) are not listed: bun omits the key when the manifest has none.
+ * @param {string} text
+ * @returns {LockedWorkspace[]}
+ */
+export function lockedWorkspaces(text) {
+  const lines = text.split(/\r?\n/)
+  /** @type {LockedWorkspace[]} */
+  const found = []
+  let inWorkspaces = false
+  let entry = ''
+  let name = ''
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index]
+    if (!inWorkspaces) {
+      if (WORKSPACES_START.test(line)) inWorkspaces = true
+      continue
+    }
+    if (!entry) {
+      if (WORKSPACES_END.test(line)) break
+      const start = ENTRY_START.exec(line)
+      if (start) {
+        entry = start[1]
+        name = ''
+      }
+      continue
+    }
+    if (ENTRY_END.test(line)) {
+      entry = ''
+      continue
+    }
+    const nameLine = NAME_LINE.exec(line)
+    if (nameLine) {
+      name = nameLine[1]
+      continue
+    }
+    const versionLine = VERSION_LINE.exec(line)
+    if (versionLine) found.push({ path: entry, name, version: versionLine[2], line: index })
+  }
+  return found
+}
+
+/**
+ * @param {string} root
+ * @param {string} workspacePath
+ * @returns {string | undefined}
+ */
+function manifestVersion(root, workspacePath) {
+  const file = join(root, workspacePath, 'package.json')
+  if (!existsSync(file)) return undefined
+  try {
+    const version = JSON.parse(readFileSync(file, 'utf8')).version
+    return typeof version === 'string' && version ? version : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Locked workspace versions that differ from their manifest.
+ * @param {string} root
+ * @returns {Array<LockedWorkspace & { manifest: string }>}
+ */
+export function bunLockVersionDrift(root) {
+  const lockPath = join(root, 'bun.lock')
+  if (!existsSync(lockPath)) return []
+  /** @type {Array<LockedWorkspace & { manifest: string }>} */
+  const drift = []
+  for (const workspace of lockedWorkspaces(readFileSync(lockPath, 'utf8'))) {
+    const manifest = manifestVersion(root, workspace.path)
+    if (manifest !== undefined && manifest !== workspace.version)
+      drift.push({ ...workspace, manifest })
+  }
+  return drift
+}
+
+/**
+ * Release-gate errors for a stale `bun.lock`.
+ * @param {string} root
+ * @returns {string[]}
+ */
+export function validateBunLockVersions(root) {
+  const drift = bunLockVersionDrift(root)
+  if (!drift.length) return []
+  const shown = drift
+    .slice(0, 3)
+    .map(
+      (entry) =>
+        `${entry.path || '.'} (${entry.name || 'unnamed'}) is ${entry.version} in bun.lock but ${entry.manifest} in package.json`
+    )
+  const more = drift.length > shown.length ? ` (+${drift.length - shown.length} more)` : ''
+  return [
+    `bun.lock records ${drift.length} workspace version(s) that differ from package.json: ${shown.join('; ')}${more}. Run code-foundry release sync-lock.`,
+  ]
+}
+
+/**
+ * Rewrite stale workspace versions in `bun.lock` to match their manifests.
+ * Only the `version` value of a drifted workspace changes.
+ * @param {string} root
+ * @param {{ dryRun?: boolean }} [options]
+ * @returns {Array<{ path: string, name: string, from: string, to: string }>}
+ */
+export function syncBunLockWorkspaceVersions(root, options = {}) {
+  const drift = bunLockVersionDrift(root)
+  if (!drift.length) return []
+  const lockPath = join(root, 'bun.lock')
+  const text = readFileSync(lockPath, 'utf8')
+  const newline = text.includes('\r\n') ? '\r\n' : '\n'
+  const lines = text.split(/\r?\n/)
+  for (const entry of drift) {
+    const match = VERSION_LINE.exec(lines[entry.line])
+    if (!match) continue
+    lines[entry.line] = `${match[1]}${entry.manifest}${match[3]}`
+  }
+  if (!options.dryRun) writeFileSync(lockPath, lines.join(newline))
+  return drift.map((entry) => ({
+    path: entry.path,
+    name: entry.name,
+    from: entry.version,
+    to: entry.manifest,
+  }))
+}

package/src/lib/node-package-performance.mjs

@@ -17,6 +17,42 @@ const METRICS = new Set([
   'productionDependencyCount',
 ])
 
+/**
+ * npm 12 keys pack reports by package name; older npm versions return an array.
+ * Count reports before validating their shape so an extra malformed entry cannot be ignored.
+ * @param {unknown} value
+ * @returns {{filename: string, size: number, unpackedSize: number, files: Array<{path: string}>}}
+ */
+export function singleNpmPackReport(value) {
+  let reports
+  if (Array.isArray(value)) reports = value
+  else if (value && typeof value === 'object') {
+    const object = /** @type {Record<string, unknown>} */ (value)
+    reports = typeof object.filename === 'string' ? [object] : Object.values(object)
+  } else reports = []
+  if (reports.length !== 1) throw new Error('Expected one npm pack report.')
+  const packed = reports[0]
+  if (!packed || typeof packed !== 'object' || Array.isArray(packed))
+    throw new Error('npm pack returned no package result.')
+  if (typeof packed.filename !== 'string' || packed.filename.length === 0)
+    throw new Error('npm pack result is missing filename.')
+  for (const field of ['size', 'unpackedSize'])
+    if (typeof packed[field] !== 'number' || !Number.isFinite(packed[field]) || packed[field] < 0)
+      throw new Error(`npm pack result is missing non-negative numeric ${field}.`)
+  if (
+    !Array.isArray(packed.files) ||
+    !packed.files.every(
+      (/** @type {unknown} */ file) =>
+        file !== null &&
+        typeof file === 'object' &&
+        !Array.isArray(file) &&
+        typeof (/** @type {{path?: unknown}} */ (file).path) === 'string'
+    )
+  )
+    throw new Error('npm pack result is missing a valid files list.')
+  return packed
+}
+
 /** @param {number[]} values @param {number} percent */
 export function percentile(values, percent) {
   if (values.length === 0) throw new Error('percentile requires at least one value')
@@ -59,8 +95,7 @@ export function runNodePackagePerformance(
     ? measureImports(root, String(policy.controlImport), samples)
     : null
   const pack = npmJson(root, ['pack', '--dry-run', '--json', '--ignore-scripts'], 'npm pack')
-  const packed = Array.isArray(pack) ? pack[0] : pack
-  if (!packed || typeof packed !== 'object') throw new Error('npm pack returned no package result.')
+  const packed = singleNpmPackReport(pack)
   /** @type {Array<{path?: string}>} */
   const files = Array.isArray(packed.files) ? packed.files : []
   const productionDependencyCount = npmProductionDependencyCount(root)

package/src/lib/product-quality.mjs

@@ -17,6 +17,7 @@ import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 import { tmpdir } from 'node:os'
 import { gzipSync } from 'node:zlib'
+import { singleNpmPackReport } from './node-package-performance.mjs'
 
 /** @typedef {Record<string, any>} Profile */
 /** @param {unknown} condition @param {string} message @returns {asserts condition} */
@@ -602,24 +603,23 @@ export function checkPackage(root, profile, output) {
   // Pack outside the consumer repository so test installations cannot become package input.
   const temporary = mkdtempSync(join(tmpdir(), 'foundry-package-quality-'))
   try {
-    const pack = JSON.parse(
-      runQualityCommand(
-        ['npm', 'pack', '--ignore-scripts', '--json', '--pack-destination', temporary],
-        root,
-        output
+    const pack = singleNpmPackReport(
+      JSON.parse(
+        runQualityCommand(
+          ['npm', 'pack', '--ignore-scripts', '--json', '--pack-destination', temporary],
+          root,
+          output
+        )
       )
     )
+    requireValue(/^[A-Za-z0-9._-]+\.tgz$/.test(pack.filename), 'Expected one package archive')
     requireValue(
-      Array.isArray(pack) && pack.length === 1 && /^[A-Za-z0-9._-]+\.tgz$/.test(pack[0].filename),
-      'Expected one package archive'
-    )
-    requireValue(
-      pack[0].files.every(
+      pack.files.every(
         (/** @type {{path:string}} */ file) => !/^\.code-foundry(?:\/|$)/.test(file.path)
       ),
       'Exclude .code-foundry quality evidence from the published package'
     )
-    const archive = ownedPath(temporary, pack[0].filename)
+    const archive = ownedPath(temporary, pack.filename)
     const archiveSha256 = createHash('sha256').update(readFileSync(archive)).digest('hex')
     const consumer = join(temporary, 'consumer')
     mkdirSync(consumer)

package/src/lib/release-policy.mjs

@@ -2,6 +2,7 @@
 
 import { existsSync, readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
+import { validateBunLockVersions } from './bun-lock.mjs'
 import { isReleasePleaseHead } from './validation-policy.mjs'
 
 const DEFAULT_RELEASE_FILES = new Set([
@@ -453,6 +454,7 @@ export function validateGeneratedReleaseDiff(input) {
     errors.push('Generated release pull request changes no version metadata.')
   }
   errors.push(...validateCargoLockVersions(root, config))
+  errors.push(...validateBunLockVersions(root))
   // Callers that can read the unified diff opt into the content audit. A null
   // patch means the diff was requested but unreadable, which must not pass.
   if (typeof patch === 'string') errors.push(...auditReleaseDiffContent(patch, { config }))

package/src/runtime-core.mjs

@@ -404,6 +404,28 @@ function validation(task) {
           { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }
         )
       : undefined
+    if (diff && diff.status !== 0) {
+      // Git can relay arbitrary remote messages, URLs and credentials on stderr. Emit only
+      // bounded, recognised failure facts; never replay remote text as workflow annotations.
+      const stderr = (diff.stderr ?? '').slice(0, 8192)
+      const missingBlob = /could not fetch ([0-9a-f]{40,64}) from promisor remote/i.exec(stderr)
+      const reason = missingBlob
+        ? `historical blob ${missingBlob[1]} unavailable from promisor remote`
+        : /authentication failed|could not read (?:username|password)|terminal prompts disabled/i.test(
+              stderr
+            )
+          ? 'authentication unavailable'
+          : /could not read from remote repository/i.test(stderr)
+            ? 'remote repository unavailable'
+            : /bad object|unknown revision|invalid symmetric difference|ambiguous argument/i.test(
+                  stderr
+                )
+              ? 'revision unavailable'
+              : 'Git error details omitted'
+      console.error(
+        `::error::Git content diff failed (status ${diff.status ?? 'unavailable'}): ${reason}.`
+      )
+    }
     const result = validateGeneratedReleaseDiff({
       headRef: process.env.FOUNDRY_HEAD_REF ?? '',
       headRepo: process.env.FOUNDRY_HEAD_REPO ?? '',