@codyswann/lisa 2.324.0 → 2.324.1

package/plugins/src/base/rules/reference/tracked-work.md

@@ -11,7 +11,7 @@ Use `lisa-track` as the single entry point:
 3. Idempotently claim the resolved leaf through `lisa-tracker-claim`, which reuses the vendor build-intake claim semantics and post-read verifies the claimed-or-later state.
 4. Before any durable repository work, persist the canonical reference with `node scripts/lisa-work-item.mjs bind <ref>` and verify the worktree-local binding.
 
-The sequence is strict: **live validate/create -> claim -> bind -> durable work**. A failed tracker read/write, claim, or binding blocks the work. Tracker availability must be proven; tool presence or stale session text is not access.
+The sequence is strict: **live validate/create -> claim -> bind -> durable work**. A tracker answer of no, and any claim or binding failure, blocks the work. A tracker that cannot be reached — `gh` absent, or its credential refused — does not block a commit: the offline checks still run, the skip is loud on stderr, and the required `Work-Item Traceability` check re-runs the live checks with credentials before anything merges. Any other tracker failure still blocks. Tool presence or stale session text is not access.
 
 ## One canonical identity
 

package/scripts/build-plugins.sh

@@ -90,6 +90,38 @@ if [ -f "$SRC_DIR/base/hooks/threshold-ratchet.mjs" ]; then
   done
 fi
 
+# Enforcement guards for host projects.
+#
+# These three are declared in the Lisa plugin, so a container whose plugin
+# install fails runs with no PreToolUse enforcement at all — silently. Lisa
+# closes that with a repository hook, which reaches a cloud session because it
+# is part of the clone; a host project needs the same thing, and has no
+# plugins/ directory to fall back on.
+#
+# Synced rather than hand-copied, for the same reason the ratchet above is: a
+# unit test asserts byte-equality, so the shipped guard can never drift from the
+# reviewed one.
+HOST_GUARD_DIR="$ROOT_DIR/all/copy-overwrite/scripts/lisa-hooks"
+if [ -d "$SRC_DIR/base/hooks" ]; then
+  mkdir -p "$HOST_GUARD_DIR"
+fi
+for guard in block-no-verify parity-safety-net block-shell-json-parsing; do
+  if [ -f "$SRC_DIR/base/hooks/$guard.sh" ]; then
+    cp "$SRC_DIR/base/hooks/$guard.sh" "$HOST_GUARD_DIR/$guard.sh"
+    chmod +x "$HOST_GUARD_DIR/$guard.sh"
+  fi
+done
+# The dispatcher itself, so a host project gets the identical entry point.
+# Guarded like the ratchet above: this script is also run against isolated
+# fixtures that carry a source tree but none of the repository's own scripts,
+# and an unconditional copy fails the whole build there.
+if [ -f "$ROOT_DIR/scripts/lisa-enforcement-fallback.sh" ]; then
+  mkdir -p "$ROOT_DIR/all/copy-overwrite/scripts"
+  cp "$ROOT_DIR/scripts/lisa-enforcement-fallback.sh" \
+    "$ROOT_DIR/all/copy-overwrite/scripts/lisa-enforcement-fallback.sh"
+  chmod +x "$ROOT_DIR/all/copy-overwrite/scripts/lisa-enforcement-fallback.sh"
+fi
+
 # Stack-specific plugins (NO base copy)
 STACKS=(typescript expo nestjs cdk harper-fabric phaser rails)
 for stack in "${STACKS[@]}"; do

package/scripts/generate-upstream-evidence-manifest.mjs

@@ -42,18 +42,57 @@ const forbiddenBasenames = new Set([
   ".mcp.json",
   "audit.local",
 ]);
-const canonicalOriginUrls = new Set([
-  "https://github.com/CodySwannGT/lisa.git",
-  "https://github.com/CodySwannGT/lisa",
-  "git@github.com:CodySwannGT/lisa.git",
-]);
+/** The repository this manifest may be generated from. Not a URL — see below. */
+const canonicalRepository = "CodySwannGT/lisa";
 
-const originUrl = execFileSync("git", ["remote", "get-url", "origin"], {
-  cwd: repoRoot,
-  encoding: "utf8",
-}).trim();
-if (!canonicalOriginUrls.has(originUrl)) {
-  throw new Error(`Refusing non-canonical Lisa origin: ${originUrl}`);
+/**
+ * The `owner/repo` an origin URL points at, or null if it names none.
+ *
+ * The guard exists to refuse hash-pinning from a fork, which is a question
+ * about **identity**. It used to compare the whole origin URL against a list of
+ * spellings, which answers a question about **transport** instead — and the two
+ * come apart in ordinary situations, not just exotic ones. `remote.origin.url`
+ * and `remote.origin.pushurl` can differ, `url.<base>.insteadOf` rewrites what
+ * `git remote get-url` returns, and a cloud container clones through a local
+ * git proxy. All three are proxied checkouts of the real repository, and all
+ * three were refused before a single hash was checked.
+ *
+ * Comparing the path keeps the property that matters: a fork is
+ * `someone-else/lisa` and is still refused, while `https://…`, `git@…` and
+ * `http://local_proxy@127.0.0.1:PORT/git/…` all resolve to the same identity.
+ * @param {string} url Whatever `git remote get-url` returned.
+ * @returns {string|null} `owner/repo`, lowercased, or null.
+ */
+function repositoryPath(url) {
+  // scp-style (git@host:owner/repo.git) is not a URL, so it is handled first.
+  const scp = /^[^/]+@[^:/]+:(?<path>.+)$/u.exec(url);
+  const raw =
+    scp?.groups?.path ?? (URL.canParse(url) ? new URL(url).pathname : null);
+  if (raw === null) return null;
+  const segments = raw
+    .replace(/\.git$/u, "")
+    .split("/")
+    .filter(Boolean);
+  if (segments.length < 2) return null;
+  return segments.slice(-2).join("/").toLowerCase();
+}
+
+// The configured value rather than the resolved one, for the same reason the
+// comparison is by path: `url.<base>.insteadOf` rewrites what `git remote
+// get-url` returns, so it answers "how do I reach this" rather than "what is
+// this". Falls back to the resolved URL only if no value is configured.
+const originUrl = execFileSync(
+  "git",
+  ["config", "--get", "remote.origin.url"],
+  { cwd: repoRoot, encoding: "utf8" }
+).trim();
+if (repositoryPath(originUrl) !== canonicalRepository.toLowerCase()) {
+  throw new Error(
+    `Refusing to generate from a non-canonical repository.\n` +
+      `origin resolves to: ${repositoryPath(originUrl) ?? "(no owner/repo)"}\n` +
+      `expected:           ${canonicalRepository}\n` +
+      `(origin URL was: ${originUrl})`
+  );
 }
 
 const tracked = execFileSync("git", ["ls-files", "-z"], {

package/scripts/lisa-enforcement-fallback.sh

@@ -34,10 +34,24 @@ if [ -f "$installed" ] && grep -q '"lisa@lisa"' "$installed" 2>/dev/null; then
   exit 0
 fi
 
+# Where the guards live depends on which repository this is.
+#
+# `plugins/lisa/hooks/` exists only in the Lisa monorepo. A host project gets
+# the same three scripts written into its checkout by `lisa apply`, because a
+# host project whose plugin install fails has exactly the same hole and no
+# `plugins/` directory to fall back on.
 status=0
 for guard in block-no-verify parity-safety-net block-shell-json-parsing; do
-  script="$repo_root/plugins/lisa/hooks/$guard.sh"
-  [ -f "$script" ] || continue
+  script=""
+  for candidate in \
+    "$repo_root/scripts/lisa-hooks/$guard.sh" \
+    "$repo_root/plugins/lisa/hooks/$guard.sh"; do
+    if [ -f "$candidate" ]; then
+      script="$candidate"
+      break
+    fi
+  done
+  [ -n "$script" ] || continue
   # Each guard reads the tool payload on stdin and signals a refusal with exit
   # 2. The payload is replayed to every one of them, and the strongest refusal
   # is returned — a guard that declines must not be able to clear one that did