@codyswann/lisa 3.14.0 → 3.14.2

package/scripts/build-plugins.sh

@@ -12,6 +12,20 @@ SRC_DIR="$PLUGINS_DIR/src"
 # Read version from package.json so plugins stay in sync with Lisa releases
 VERSION=$(node -e "console.log(require('$ROOT_DIR/package.json').version)")
 
+# Materialize a Lisa-owned source file into a copy-overwrite/ template tree.
+#
+# Never a plain `cp`. These destinations are `copy-overwrite` assets, and a
+# `copy-overwrite` asset that reads as editable silently loses downstream
+# hardening on the next sync — already observed on block-no-verify.sh. They are
+# also the only assets that cannot carry a hand-typed ownership header, because
+# this script would erase it on the next build (#2547). So the header is stamped
+# here, as the file is generated: the authored source stays honest about being
+# editable, the shipped copy states that it is replaced, and the two cannot
+# disagree because one produces the other.
+materialize() {
+  node "$ROOT_DIR/scripts/materialize-copy-overwrite.mjs" "$1" "$2"
+}
+
 inject_version() {
   local manifest="$1"
   if [ -f "$manifest" ]; then
@@ -82,11 +96,12 @@ if [ -f "$SRC_DIR/base/hooks/threshold-ratchet.mjs" ]; then
     mkdir -p "$ratchet_scripts_dir"
     # The entry point takes the template check-* naming; its relative imports
     # (threshold-ratchet-*.mjs) keep their canonical names in both trees.
-    cp "$SRC_DIR/base/hooks/threshold-ratchet.mjs" \
+    materialize "$SRC_DIR/base/hooks/threshold-ratchet.mjs" \
       "$ratchet_scripts_dir/check-threshold-ratchet.mjs"
-    cp "$SRC_DIR/base/hooks/threshold-ratchet-families.mjs" \
-      "$SRC_DIR/base/hooks/threshold-ratchet-compare.mjs" \
-      "$ratchet_scripts_dir/"
+    for ratchet_module in threshold-ratchet-families threshold-ratchet-compare; do
+      materialize "$SRC_DIR/base/hooks/$ratchet_module.mjs" \
+        "$ratchet_scripts_dir/$ratchet_module.mjs"
+    done
   done
 fi
 
@@ -108,7 +123,7 @@ fi
 for guard in block-no-verify parity-safety-net block-shell-json-parsing \
   block-instruction-file-edits block-direct-issue-create; do
   if [ -f "$SRC_DIR/base/hooks/$guard.sh" ]; then
-    cp "$SRC_DIR/base/hooks/$guard.sh" "$HOST_GUARD_DIR/$guard.sh"
+    materialize "$SRC_DIR/base/hooks/$guard.sh" "$HOST_GUARD_DIR/$guard.sh"
     chmod +x "$HOST_GUARD_DIR/$guard.sh"
   fi
 done
@@ -122,7 +137,8 @@ done
 # guards are, not because it is dispatched the same way.
 if [ -f "$SRC_DIR/base/hooks/sonar-secrets.sh" ]; then
   mkdir -p "$HOST_GUARD_DIR"
-  cp "$SRC_DIR/base/hooks/sonar-secrets.sh" "$HOST_GUARD_DIR/sonar-secrets.sh"
+  materialize "$SRC_DIR/base/hooks/sonar-secrets.sh" \
+    "$HOST_GUARD_DIR/sonar-secrets.sh"
   chmod +x "$HOST_GUARD_DIR/sonar-secrets.sh"
 fi
 
@@ -132,7 +148,7 @@ fi
 # and an unconditional copy fails the whole build there.
 if [ -f "$ROOT_DIR/scripts/lisa-enforcement-fallback.sh" ]; then
   mkdir -p "$ROOT_DIR/all/copy-overwrite/scripts"
-  cp "$ROOT_DIR/scripts/lisa-enforcement-fallback.sh" \
+  materialize "$ROOT_DIR/scripts/lisa-enforcement-fallback.sh" \
     "$ROOT_DIR/all/copy-overwrite/scripts/lisa-enforcement-fallback.sh"
   chmod +x "$ROOT_DIR/all/copy-overwrite/scripts/lisa-enforcement-fallback.sh"
 fi

package/scripts/generate-lisa-owned-hash-ledger.mjs

@@ -28,6 +28,7 @@ const repoRoot = path.resolve(import.meta.dirname, "..");
 const outputPath = path.join(repoRoot, "src/core/lisa-owned-hash-ledger.ts");
 const COPY_OVERWRITE = "copy-overwrite";
 const LISA_NAMESPACE_PREFIX = "lisa-";
+const ENFORCEMENT_TREE = "scripts/";
 
 /**
  * Run a git command in the repository and return stdout as latin1 text.
@@ -51,27 +52,32 @@ function git(args) {
 }
 
 /**
- * Whether a destination path sits in the namespace Lisa owns outright.
+ * Whether a destination path sits in the territory Lisa owns outright.
  *
  * Mirrors `isLisaOwnedTemplate` in `src/core/lisa-owned-templates.ts`. The
  * duplication is deliberate — this script runs before the TypeScript build, so
  * it cannot import the compiled module — and a test asserts the two agree.
  *
- * This is also the ledger's boundary, and it is inherited rather than chosen.
- * The `lisa-` path segment is what decides which files refresh at all, so a file
- * outside it is never refreshed after its initial create and has nothing for
- * provenance to decide — recording hashes for it would add a regeneration gate
- * to ~120 more templates and buy nothing today. If that predicate is ever
- * replaced (CodySwannGT/lisa#2491 tracks it freezing non-`lisa-` guards at
- * whatever version first landed), widening enrolment is this one function: the
- * ledger answers "has Lisa ever shipped these bytes here?" for any managed path.
+ * This is also the ledger's boundary, and it is inherited rather than chosen:
+ * whatever refresh acts on is what provenance has to be able to judge. That is
+ * why the two widened together in CodySwannGT/lisa#2551. This function's earlier
+ * self predicted it — "widening enrolment is this one function" — and the note
+ * is worth keeping, because the direction of the dependency is the load-bearing
+ * part: enrolment must never lag the predicate. `classifyHostCopy` returns
+ * `unenrolled` for a path it has no hashes for, and refresh reads that as
+ * permission to overwrite, so a file the predicate newly owns but the ledger has
+ * not recorded is not merely unprotected — it is clobbered on the next apply.
+ * A test asserts the containment in that direction so the two cannot drift.
  * @param {string} destination - Repo-relative destination path
  * @returns {boolean} True when Lisa owns the file outright
  */
 function isLisaOwned(destination) {
-  return destination
-    .split("/")
-    .some(segment => segment.startsWith(LISA_NAMESPACE_PREFIX));
+  return (
+    destination.startsWith(ENFORCEMENT_TREE) ||
+    destination
+      .split("/")
+      .some(segment => segment.startsWith(LISA_NAMESPACE_PREFIX))
+  );
 }
 
 /**

package/scripts/materialize-copy-overwrite.mjs

@@ -0,0 +1,163 @@
+#!/usr/bin/env node
+/**
+ * Copy a Lisa-owned file into a `copy-overwrite/` template tree, stamping the
+ * ownership header on the way in.
+ *
+ * Thirteen `copy-overwrite` assets are not authored where they ship. The build
+ * materializes them from `plugins/src/base/hooks/` (the five PreToolUse guards,
+ * the Sonar wrapper, the three threshold-ratchet modules into two stack lanes)
+ * and from `scripts/lisa-enforcement-fallback.sh` (the dispatcher). A header
+ * typed into the shipped copy is erased by the next `bun run build`, which is
+ * why those thirteen were the only files #2545 could not correct.
+ *
+ * The header cannot move upstream to the source either. `plugins/src/base/hooks/
+ * block-no-verify.sh` is precisely the file maintainers edit, so telling it that
+ * it will be overwritten would be a fresh instance of the false statement #2538
+ * exists to remove. So the header becomes a property of the *generation step*:
+ * the source stays honest, the shipped copy states its real contract, and the
+ * two can never disagree because one produces the other.
+ *
+ * This matters most on exactly these files. A `copy-overwrite` asset that reads
+ * as editable silently loses downstream hardening — a consumer repo hardened its
+ * `block-no-verify.sh` and the next sync reverted it, noticed only because two
+ * of its own tests started failing.
+ * @module scripts/materialize-copy-overwrite
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+/**
+ * The `copy-overwrite` ownership contract, verbatim from the header #2545
+ * established. Duplicated nowhere: `tests/unit/templates/
+ * template-ownership-header.test.ts` asserts the same two sentences over every
+ * template in the lane, and this generator writes them into the thirteen that
+ * cannot hold a hand-typed copy.
+ */
+export const OWNERSHIP_HEADER = [
+  "This file is managed by Lisa and IS replaced on each `lisa` run.",
+  "Do not edit directly — durable changes belong upstream in Lisa.",
+];
+
+/**
+ * Line comment syntax per extension, for the formats this generator emits.
+ *
+ * Deliberately a closed map rather than a default. A file type that is not
+ * listed makes `materialize` throw, so wiring a new generated asset through
+ * here is a decision someone has to make — the alternative is a silent
+ * pass-through that reintroduces the headerless copy this module exists to end.
+ */
+const COMMENT_PREFIX = new Map([
+  [".sh", "#"],
+  [".bash", "#"],
+  [".mjs", "//"],
+  [".cjs", "//"],
+  [".js", "//"],
+]);
+
+/**
+ * The comment prefix a generated file's format uses.
+ * @param {string} filePath - Path whose extension selects the syntax.
+ * @returns {string | undefined} Prefix, or undefined when unsupported.
+ */
+export const commentPrefixFor = filePath =>
+  COMMENT_PREFIX.get(path.extname(filePath));
+
+/**
+ * The header block as it appears in a file of the given comment syntax.
+ * @param {string} prefix - Line comment prefix, e.g. `#` or `//`.
+ * @returns {string[]} The header lines, ready to splice in.
+ */
+const headerLines = prefix => OWNERSHIP_HEADER.map(line => `${prefix} ${line}`);
+
+/**
+ * Whether contents already state the ownership contract.
+ * @param {string} contents - File contents.
+ * @returns {boolean} True when every header sentence is present.
+ */
+export const hasOwnershipHeader = contents =>
+  OWNERSHIP_HEADER.every(line => contents.includes(line));
+
+/**
+ * Contents with the ownership header stamped in.
+ *
+ * Placement is not cosmetic: a `#!` line that stops being line 1 stops being a
+ * shebang, so the header lands *below* it when one is present. Idempotent, so
+ * re-running the build over an already-stamped tree is a no-op rather than a
+ * pile of headers.
+ * @param {string} contents - Source file contents.
+ * @param {string} filePath - Destination path, for its extension.
+ * @returns {string} Contents carrying the header.
+ * @throws {Error} When the destination's format has no known comment syntax.
+ */
+export const withOwnershipHeader = (contents, filePath) => {
+  const prefix = commentPrefixFor(filePath);
+  if (prefix === undefined) {
+    throw new Error(
+      `No comment syntax known for ${path.basename(filePath)} — a generated ` +
+        `copy-overwrite asset must be able to state its ownership contract.`
+    );
+  }
+  if (hasOwnershipHeader(contents)) return contents;
+
+  const lines = contents.split("\n");
+  const insertAt = lines[0]?.startsWith("#!") ? 1 : 0;
+  return [
+    ...lines.slice(0, insertAt),
+    ...headerLines(prefix),
+    "",
+    ...lines.slice(insertAt),
+  ].join("\n");
+};
+
+/**
+ * Contents with the ownership header removed, leaving the authored source.
+ *
+ * The byte-equality tests that pin a shipped copy to its reviewed original run
+ * through here, so "generated file minus its stamp" has exactly one definition
+ * and cannot drift from what the stamp step actually writes.
+ * @param {string} contents - Generated file contents.
+ * @param {string} filePath - Path, for its comment syntax.
+ * @returns {string} Contents without the header block.
+ */
+export const withoutOwnershipHeader = (contents, filePath) => {
+  const prefix = commentPrefixFor(filePath);
+  if (prefix === undefined) return contents;
+
+  const block = headerLines(prefix);
+  const lines = contents.split("\n");
+  const at = lines.findIndex(
+    (line, index) => line === block[0] && lines[index + 1] === block[1]
+  );
+  if (at === -1) return contents;
+
+  // The blank separator belongs to the stamp, not to the source, so it comes
+  // out with it — otherwise round-tripping would grow a line each build.
+  const end =
+    lines[at + block.length] === "" ? at + block.length + 1 : at + block.length;
+  return [...lines.slice(0, at), ...lines.slice(end)].join("\n");
+};
+
+/**
+ * Read a source file and write it to a destination carrying the header.
+ * @param {string} source - Authored file to materialize.
+ * @param {string} destination - Path inside a `copy-overwrite/` tree.
+ * @returns {void}
+ */
+export const materialize = (source, destination) => {
+  writeFileSync(
+    destination,
+    withOwnershipHeader(readFileSync(source, "utf8"), destination)
+  );
+};
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  const [source, destination] = process.argv.slice(2);
+  if (!source || !destination) {
+    console.error(
+      "usage: materialize-copy-overwrite.mjs <source> <destination>"
+    );
+    process.exit(1);
+  }
+  materialize(source, destination);
+}

package/typescript/copy-overwrite/.github/GITHUB_ACTIONS.md

@@ -1,3 +1,6 @@
+<!-- This file is managed by Lisa and IS replaced on each `lisa` run. -->
+<!-- Do not edit directly — durable changes belong upstream in Lisa. -->
+
 # GitHub Actions Configuration
 
 This directory contains the CI/CD workflows and automation for the project. This document explains how to configure and use the GitHub Actions workflows.

package/typescript/copy-overwrite/ast-grep/rules/no-inline-component-in-container.yml

@@ -1,3 +1,6 @@
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
 id: no-inline-component-in-container
 language: tsx
 severity: error

package/typescript/copy-overwrite/ast-grep/rules/no-inline-component-in-view.yml

@@ -1,3 +1,6 @@
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
 id: no-inline-component-in-view
 language: tsx
 severity: error

package/typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
 /**
  * Threshold ratchet gate — quality thresholds may tighten, never weaken.
  *

package/typescript/copy-overwrite/scripts/threshold-ratchet-compare.mjs

@@ -1,3 +1,6 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
 /**
  * Threshold ratchet — comparison rules and reporting.
  *

package/typescript/copy-overwrite/scripts/threshold-ratchet-families.mjs

@@ -1,3 +1,6 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
 /**
  * Threshold ratchet — watched file families and value extractors.
  *