@codyswann/lisa 2.342.0 → 2.342.1

package/all/copy-overwrite/scripts/lisa-floor-collisions.mjs

@@ -47,19 +47,51 @@ const DEPENDENCY_SECTIONS = [
   "peerDependencies",
 ];
 
+/**
+ * Lowest version a single disjunction branch permits.
+ *
+ * An upper-bound-only branch (`<2.0.0`, `<=2.0.0`) has no floor: it permits
+ * everything beneath the bound, so its lower bound is zero. Every other form
+ * used in practice (`>=1.2.3`, `^1.2.3`, `~1.2.3`, `1.2.3`, `>=1.2.3 <2`)
+ * leads with its lower bound.
+ * @param {string} branch One branch of a `||` range.
+ * @returns {number[]|null} [major, minor, patch], or null when there is none.
+ */
+function branchLowerBound(branch) {
+  const trimmed = branch.trim();
+  if (trimmed === "") return null;
+  if (/^<=?\s*\d/.test(trimmed)) return [0, 0, 0];
+  const match = /(\d+)\.(\d+)\.(\d+)/.exec(trimmed);
+  return match ? match.slice(1, 4).map(Number) : null;
+}
+
 /**
  * Lowest version a range permits, as a comparable tuple.
  *
- * Deliberately crude: it reads the first version in the spec, which is the
- * lower bound for every form used in practice (`>=1.2.3`, `^1.2.3`, `~1.2.3`,
- * `1.2.3`, `>=1.2.3 <2`). A spec carrying no version — `*`, `workspace:*`,
- * `latest` — has no floor to compare and returns null.
+ * Reading only the first version in the spec was wrong in a direction that
+ * matters: for `^2.0.0 || ^1.9.0` it reported 2.0.0, a floor HIGHER than the
+ * range actually permits, and the caller's `compare(target, floor) >= 0` then
+ * skipped a genuine collision. A floor read too high is a false negative in a
+ * security check, so every branch is measured and the lowest wins.
+ *
+ * An alias spec (`npm:other-pkg@^1.2.3`) versions a different package
+ * entirely; its number cannot be compared against a floor for this name, so it
+ * returns null rather than a misleading answer. A spec carrying no version —
+ * `*`, `workspace:*`, `latest` — has no floor either.
  * @param {string} spec A version range.
  * @returns {number[]|null} [major, minor, patch], or null when there is none.
  */
 export function lowestPermitted(spec) {
-  const match = /(\d+)\.(\d+)\.(\d+)/.exec(spec ?? "");
-  return match ? match.slice(1, 4).map(Number) : null;
+  const raw = spec ?? "";
+  if (/^\s*npm:/i.test(raw)) return null;
+  const bounds = raw
+    .split("||")
+    .map(branchLowerBound)
+    .filter(bound => bound !== null);
+  if (bounds.length === 0) return null;
+  return bounds.reduce((lowest, bound) =>
+    compare(bound, lowest) < 0 ? bound : lowest
+  );
 }
 
 /**

package/all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh

@@ -172,16 +172,6 @@ case "$command_str" in
     ;;
 esac
 
-# matches / matches_cs run an ERE against the guarded command text. matches is
-# case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
-# for guards where flag case is meaningful (`git branch -d` vs `-D`).
-matches() {
-  printf '%s' "$command_for_guards" | grep -Eiq -- "$1"
-}
-matches_cs() {
-  printf '%s' "$command_for_guards" | grep -Eq -- "$1"
-}
-
 # Normalize bash line-continuations (a trailing backslash + newline → space)
 # before segmenting the command. Without this, "git push --force origin
 # \<newline>main" splits into a segment matching --force but not `main`, letting a
@@ -190,6 +180,28 @@ matches_cs() {
 normalized_command_str="$(printf '%s' "$command_for_guards" \
   | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
 
+# matches / matches_cs run an ERE against the guarded command text. matches is
+# case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
+# for guards where flag case is meaningful (`git branch -d` vs `-D`).
+#
+# Both read the NORMALIZED text. They used to read $command_for_guards, so only
+# the two segment-walking guards (rm, git push) were protected against line
+# continuations and every guard expressed through these helpers could be evaded
+# by breaking the command across lines:
+#
+#     git reset --hard \
+#       origin/main
+#
+# The patterns match on intermediate whitespace, and an embedded "\<newline>" is
+# not whitespace to grep -E, so the anchor failed to span the break. Defined
+# after the normalization above so the value exists when these are first called.
+matches() {
+  printf '%s' "$normalized_command_str" | grep -Eiq -- "$1"
+}
+matches_cs() {
+  printf '%s' "$normalized_command_str" | grep -Eq -- "$1"
+}
+
 # Shared ERE fragments. GIT_TOKENS walks over intermediate argv tokens without
 # crossing a statement separator, so a flag in a LATER statement can never be
 # attributed to an earlier git subcommand.
@@ -553,9 +565,28 @@ if [ -f "$rules_file" ]; then
     case "$rule" in
       '' | '#'*) continue ;;
     esac
-    if printf '%s' "$command_for_guards" | grep -Eiq -- "$rule"; then
-      block "matched a project custom safety rule (${rules_file##*/}): $rule"
-    fi
+    # Normalized text, for the same reason every built-in guard uses it: a
+    # project rule must not be evadable by breaking the command across lines.
+    #
+    # `|| rule_status=$?` rather than a bare pipeline: this script runs under
+    # `set -e`, and a no-match grep exits 1, which would end the hook right
+    # here — before the remaining rules ran, and with an exit status that is
+    # not a refusal. The `||` puts the pipeline in a condition context, where
+    # a non-zero status is expected rather than fatal.
+    rule_status=0
+    printf '%s' "$normalized_command_str" | grep -Eiq -- "$rule" || rule_status=$?
+    case "$rule_status" in
+      0) block "matched a project custom safety rule (${rules_file##*/}): $rule" ;;
+      1) ;; # no match
+      # grep exits 2 on a malformed ERE. Treated as no-match before, so a typo
+      # in a project's rules file silently disabled that rule — a guard the
+      # project believed it had. Say so instead; still non-fatal, because one
+      # bad line must not take the other rules down with it.
+      *)
+        printf 'parity-safety-net: invalid regex in %s, rule NOT enforced: %s\n' \
+          "$rules_file" "$rule" >&2
+        ;;
+    esac
   done <"$rules_file"
 fi
 

package/all/create-only/scripts/remote-agent-aws-setup.sh

@@ -6,7 +6,14 @@ set -euo pipefail
 
 if NPM_ROOT="$(npm root 2>/dev/null)" && [ -n "$NPM_ROOT" ]; then
   LOCAL_LISA_SCRIPT="$NPM_ROOT/@codyswann/lisa/plugins/lisa/scripts/remote-agent-aws-setup.sh"
-  [ -x "$LOCAL_LISA_SCRIPT" ] && exec "$LOCAL_LISA_SCRIPT" "$@"
+  # Spelled as a full `if` rather than `[ -x … ] && exec …`. That form is the
+  # last command in this block, so when the file is absent its non-zero status
+  # is the block's status, and `set -e` exits (1) right here — before the
+  # diagnostic below can print. The operator saw a silent failure instead of
+  # being told to install the package.
+  if [ -x "$LOCAL_LISA_SCRIPT" ]; then
+    exec "$LOCAL_LISA_SCRIPT" "$@"
+  fi
 fi
 
 echo "remote-agent-aws-setup: install @codyswann/lisa before running this setup script" >&2

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwqEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAovNjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwqEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAqvNjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -4,16 +4,16 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/copy-contents/.gitattributes": "9d3831007e681186a3673e1037ef3fc82980cab2fc04e27c0868e562912c9e9f",
     "all/copy-contents/gitignore": "2dbf7fd2f2020fc7824c432342002d9ca3ebb57b2872e761b14e942b23479a11",
     "all/copy-overwrite/scripts/lisa-enforcement-fallback.sh": "1bec5f3c284b3febdc471487ee6a23ffb72bd4e7b293f9e26b0188f32318c722",
-    "all/copy-overwrite/scripts/lisa-floor-collisions.mjs": "a612f172282d13ba9318fe5e03689d7c6ff42a0122d0c9d5d39051e1967b93dc",
+    "all/copy-overwrite/scripts/lisa-floor-collisions.mjs": "3c7a0234b4f5609fce49e44711d2ec86af8cf7fb82b0831e4450e3347ecefe45",
     "all/copy-overwrite/scripts/lisa-hooks/block-instruction-file-edits.sh": "850cfc23852eb752114ae1e938a1c7bcf34bc50c85d3aaca0c02311cc8c0ef70",
     "all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh": "33e2bd341eb992036059b0c4606db35a218adcfeca7e44d174fedf8ebdff29d2",
     "all/copy-overwrite/scripts/lisa-hooks/block-shell-json-parsing.sh": "1934a15e154fda3c2a40979a5cd6225661b14fe7bc77328a69ce499bea85dba7",
-    "all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh": "062c69eea85157f1e941ec3626d8912aa9f182af6ccdbe19687588a6074db5ce",
+    "all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh": "d9ea58150aa27e7f0aa9a4ef155ed446d30bdfc932d01c64e2b8ca211aa0de7b",
     "all/copy-overwrite/scripts/lisa-hooks/sonar-secrets.sh": "bf4132e49ba18e2f7e941520c299c15aeeacfd220e489f3d2eb8397f2048157b",
     "all/copy-overwrite/scripts/lisa-work-item.mjs": "2d9ca0841db9e75ddfd95e3a4d485fd01aa639a512ef648996f565b7991d8e2b",
     "all/create-only/.claude/rules/PROJECT_RULES.md": "6e1c7923ad2a15356babc60c97e7f97be728d790af285b6a7cd7d1b4d39cd97f",
     "all/create-only/.lisaignore": "3c9827e7e98daa46510b5357cd6dd9406da1821e64cc46d2eea9f311cd6d06b9",
-    "all/create-only/scripts/remote-agent-aws-setup.sh": "7677908a345891810d2104ba8b2fd1a8318bb29c408fb5ce0110d57beef9b556",
+    "all/create-only/scripts/remote-agent-aws-setup.sh": "12d2204d34195ad4f81082e90a25dbbf7d2493debcc50c1cd37b32dc4648fc17",
     "all/create-only/specs/.keep": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
     "all/deletions.json": "31af98085a56dd96d34d4b3cb42956e068fb492df7b1dd781987408c1b4b2ea3",
     "all/github-rulesets/base.json": "58b9606f185cdca8b17218829aac333b7d8c08f0f2b4f86d7e360f7be1de4787",
@@ -310,13 +310,13 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/hooks/install-pkgs.sh": "e9a13faba849a277410dde911ab102ee6f88ef915b33571bb1d4eef904172db5",
     "plugins/src/base/hooks/parity-safety-net-heredoc.py": "f21b1232ac82bd0e42d2ba43c68f4cc4546334fc885ba31747881f427097ef78",
     "plugins/src/base/hooks/parity-safety-net.agy.sh": "ce9bd2b4566ad9147e4ace56434cffbbe87edb4ccbb57549ab3fd9f4c671ced4",
-    "plugins/src/base/hooks/parity-safety-net.sh": "062c69eea85157f1e941ec3626d8912aa9f182af6ccdbe19687588a6074db5ce",
+    "plugins/src/base/hooks/parity-safety-net.sh": "d9ea58150aa27e7f0aa9a4ef155ed446d30bdfc932d01c64e2b8ca211aa0de7b",
     "plugins/src/base/hooks/setup-jira-cli.sh": "a675f6b17ce7f0d6b9fb7daeba6d2bc59bcb48ef79b034076ea73b2b1e72ee09",
     "plugins/src/base/hooks/shell-write-nudge.sh": "69839af423f8792b1e52c71097316c3264425553031627c0a2f9409a9d5becd0",
     "plugins/src/base/hooks/sonar-secrets.sh": "bf4132e49ba18e2f7e941520c299c15aeeacfd220e489f3d2eb8397f2048157b",
     "plugins/src/base/hooks/threshold-ratchet-compare.mjs": "4535a145c5c5cbee13bdf970bc91d390a264043604e607288cdd6bf28de56192",
     "plugins/src/base/hooks/threshold-ratchet-families.mjs": "db14245ed89b483912af287bdee917a7a921dc21bb29b49be37fc799c05c413f",
-    "plugins/src/base/hooks/threshold-ratchet.mjs": "04f660131bf50864239eb09cbf4d9555e53921254f6ab45ff2b85c173e160901",
+    "plugins/src/base/hooks/threshold-ratchet.mjs": "49dee610439f4f21aecb0420a0cc72f5d3595a36f2489970053096190b9909c4",
     "plugins/src/base/hooks/threshold-ratchet.sh": "b86f4d0b554e44fd119ad8a8920cd0ba6c9dbe779f7ee219d381cf0629453990",
     "plugins/src/base/hooks/ticket-sync-reminder.sh": "212f80bcdfd9e3ec2254987c5a7186d1d2d38065b330ddcdc631f76df7c4a6c0",
     "plugins/src/base/hooks/track-plan-sessions.sh": "8bc47dcad3aed628df0c9efbe7b6f3df87635b94b0c54c71e0bd52eceace563a",
@@ -947,7 +947,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "rails/copy-overwrite/ast-grep/utils/.gitkeep": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
     "rails/copy-overwrite/config/initializers/version.rb": "fa664a84f407877b5ddbd3709a2352b30e4dc6fbce538a8503bad6c52448dc86",
     "rails/copy-overwrite/lefthook.yml": "28bb382b9171a04fb92ebafc1f1522b8639f5edc4fcffcc6940e7fba3460fb4e",
-    "rails/copy-overwrite/scripts/check-threshold-ratchet.mjs": "04f660131bf50864239eb09cbf4d9555e53921254f6ab45ff2b85c173e160901",
+    "rails/copy-overwrite/scripts/check-threshold-ratchet.mjs": "49dee610439f4f21aecb0420a0cc72f5d3595a36f2489970053096190b9909c4",
     "rails/copy-overwrite/scripts/lisa-clean-git-env.sh": "e7121a0ee9e1bf7c01cd2ab55f563dd6d9ab75990739bb6ddf571a513efa10e9",
     "rails/copy-overwrite/scripts/threshold-ratchet-compare.mjs": "4535a145c5c5cbee13bdf970bc91d390a264043604e607288cdd6bf28de56192",
     "rails/copy-overwrite/scripts/threshold-ratchet-families.mjs": "db14245ed89b483912af287bdee917a7a921dc21bb29b49be37fc799c05c413f",
@@ -1070,7 +1070,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/copy-overwrite/eslint.ignore.config.json": "04dcd754829cf93bf0ba0d76e4031d28cb7149afa658575d02bb13bf73f7880e",
     "typescript/copy-overwrite/eslint.slow.config.ts": "f66d04381940936544931d7f20ffd4e43c38b8a907d56ffa101e2236371d8c94",
     "typescript/copy-overwrite/knip.json": "6eb93d705a2d645332fbae1dd42cf2d48f85978ebc265451a53790912f277d12",
-    "typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs": "04f660131bf50864239eb09cbf4d9555e53921254f6ab45ff2b85c173e160901",
+    "typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs": "49dee610439f4f21aecb0420a0cc72f5d3595a36f2489970053096190b9909c4",
     "typescript/copy-overwrite/scripts/check-verification-coverage.mjs": "3c1d27d0668fc66a18cb014f2b607878f0a88c178a773fbe964b8e46b19e86d6",
     "typescript/copy-overwrite/scripts/lisa-mutation.mjs": "7d8d24dea151ef2178807046e97aea7ebfadd9c88eb50347feb7bb4bb190227d",
     "typescript/copy-overwrite/scripts/threshold-ratchet-compare.mjs": "4535a145c5c5cbee13bdf970bc91d390a264043604e607288cdd6bf28de56192",
@@ -7352,6 +7352,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/hooks/parity-safety-net-heredoc-continuation.test.ts": true,
     "tests/unit/hooks/parity-safety-net-heredoc-literal.test.ts": true,
     "tests/unit/hooks/parity-safety-net-heredoc.test.ts": true,
+    "tests/unit/hooks/parity-safety-net-line-continuation.test.ts": true,
     "tests/unit/hooks/parity-safety-net.test.ts": true,
     "tests/unit/hooks/post-checkout.test.ts": true,
     "tests/unit/hooks/pre-push-git-environment.test.ts": true,