@codyswann/lisa 3.16.0 → 3.17.0

package/typescript/copy-contents/.husky/pre-commit

@@ -43,9 +43,99 @@ else
   fi
 fi
 
+# ---------------------------------------------------------------------------
+# Gate-driven checks.
+#
+# A gate is a PROPERTY the project must hold; `.lisa.config.json` names the task
+# that proves it. `gitleaks` is not a gate — credential leakage is, and gitleaks
+# is one way to prove it. When a `gates` block exists, that registry decides
+# what runs at the `commit` moment, not the hardcoded list further down.
+#
+# BACKWARD COMPATIBILITY — read before changing any of this. Most installed
+# projects have NO `gates` block. The exit codes are the switch:
+#
+#   exit 0  → the declared gates at this moment ran and none of them blocked.
+#   exit 1  → a required gate FAILED. Block the commit.
+#   exit 78 → there is no `gates` block at all. Nothing is covered.
+#   other   → the runner itself could not run (config unreadable, crash).
+#             Nothing was proved. Say so loudly and cover nothing.
+#
+# ONE STEP AT A TIME, NOT ALL OR NOTHING. Exit 0 says the declared gates
+# passed. It does not say the registry covers every property the steps below
+# prove — so it cannot be the thing that skips them wholesale. A block that
+# declares `code-style` and says nothing about `credential-leakage` would then
+# delete the secret scan by omission, which is the failure this whole subsystem
+# exists to prevent: a control returning success for an input it never
+# examined.
+#
+# So the runner writes the properties it covers into $LISA_GATE_COVERAGE, one
+# gate id per line, and every built-in step below stands down only against its
+# OWN property. A half-declared block therefore loses nothing: the registry
+# runs what it declares and the built-ins run the rest.
+#
+# Fail-safe by construction: no coverage file, an empty one, a runner that
+# could not run, or no exact match, all mean the built-in step runs.
+# ---------------------------------------------------------------------------
+GATE_RUNNER="scripts/lisa-run-gates.mjs"
+if [ ! -f "$GATE_RUNNER" ]; then
+  GATE_RUNNER="all/copy-overwrite/scripts/lisa-run-gates.mjs"
+fi
+LISA_GATE_COVERAGE=""
+if [ -f "$GATE_RUNNER" ] && command -v node >/dev/null 2>&1; then
+  LISA_GATE_COVERAGE="$(mktemp "${TMPDIR:-/tmp}/lisa-gate-coverage.XXXXXXXX")" || LISA_GATE_COVERAGE=""
+  trap 'rm -f "$LISA_GATE_COVERAGE"' EXIT
+  if [ -n "$LISA_GATE_COVERAGE" ]; then
+    node "$GATE_RUNNER" --moment=commit --coverage="$LISA_GATE_COVERAGE"
+  else
+    # No temp file, so nothing can be covered and every built-in step runs.
+    node "$GATE_RUNNER" --moment=commit
+  fi
+  GATE_STATUS=$?
+  if [ $GATE_STATUS -eq 1 ]; then
+    echo ""
+    echo "❌ Commit blocked: a required gate failed. See the FAILED line above."
+    echo ""
+    exit 1
+  fi
+  if [ $GATE_STATUS -ne 0 ]; then
+    # Anything other than a clean run: discard whatever is in the file. A
+    # runner that crashed midway may have written coverage before it failed,
+    # and coverage from a run that did not finish is not evidence.
+    if [ -n "$LISA_GATE_COVERAGE" ]; then
+      : > "$LISA_GATE_COVERAGE"
+    fi
+    if [ $GATE_STATUS -ne 78 ]; then
+      echo ""
+      echo "⚠️  The gate runner could not run (exit $GATE_STATUS)."
+      echo "   Nothing was proved by the gate registry — this is NOT a pass."
+      echo "   Running the built-in checks instead."
+      echo ""
+    fi
+  fi
+else
+  echo "ℹ️  Gate runner unavailable; running the built-in checks."
+fi
+
+# Whether a declared gate covers every property named, so the built-in step
+# that proves them can stand down. Exact whole-line matching: a gate id that is
+# a prefix of another must never satisfy it.
+lisa_gate_covers() {
+  [ -n "$LISA_GATE_COVERAGE" ] || return 1
+  [ -s "$LISA_GATE_COVERAGE" ] || return 1
+  for _lisa_gate in "$@"; do
+    grep -Fqx -- "$_lisa_gate" "$LISA_GATE_COVERAGE" || return 1
+  done
+  return 0
+}
+
+# BEGIN: built-in checks — the pre-registry path, kept step for step so a
+# project without a `gates` block behaves exactly as it did before.
+
 # Check for Gitleaks and run secret detection
 echo "🔐 Checking for secrets with Gitleaks..."
-if command -v gitleaks >/dev/null 2>&1; then
+if lisa_gate_covers credential-leakage; then
+  echo "ℹ️  Covered by the credential-leakage gate; the built-in scan stands down."
+elif command -v gitleaks >/dev/null 2>&1; then
   # Run gitleaks on staged files. Lisa keeps the host-owned allowlist in
   # .gitleaksignore and shared managed entries in .gitleaksignore.local.
   GITLEAKS_IGNORE_ARGS=""
@@ -109,10 +199,49 @@ fi
 #   exit 1
 # fi
 
+# Run lint-staged for incremental lint and format checks. It proves three
+# properties in one pass — oxlint/eslint, prettier, and `ast-grep scan` — so it
+# stands down only when a gate is declared for every one of them.
+if lisa_gate_covers code-style format-conformance structural-rules; then
+  echo "ℹ️  Lint, format and structural rules are covered by gates; lint-staged stands down."
+else
+  echo "🚀 Running lint-staged..."
+  $EXECUTOR lint-staged --config .lintstagedrc.json
+  LINT_STAGED_STATUS=$?
+  if [ $LINT_STAGED_STATUS -ne 0 ]; then
+    exit $LINT_STAGED_STATUS
+  fi
+fi
+
+# Generated artifacts must vouch for the bytes committed beside them. Runs AFTER
+# lint-staged on purpose: reformatting a staged template moves its bytes, so a
+# check placed above would sign off on bytes that no longer exist. Absent in host
+# projects, which have the hook but none of Lisa's generators.
+if lisa_gate_covers artifact-freshness; then
+  echo "ℹ️  Covered by the artifact-freshness gate; the built-in check stands down."
+elif [ -f "scripts/check-derived-artifacts.mjs" ] && command -v node >/dev/null 2>&1; then
+  echo "🧾 Checking generated artifacts..."
+  node scripts/check-derived-artifacts.mjs --staged
+  if [ $? -ne 0 ]; then
+    exit 1
+  fi
+fi
+
+# END: built-in checks
+
 # Threshold ratchet: quality thresholds may tighten, never weaken. The staged
 # change is compared against HEAD by the same deterministic comparator the
 # agent-time hooks and CI run; human-approved exceptions live in
 # .lisa.config.json under thresholdRatchet.allow.
+#
+# OUTSIDE the gate-registry handover, deliberately. Every other built-in step
+# here has a registry gate that can replace it, so the runner refuses to take
+# the moment until the block declares one — see BUILTIN_FLOOR and
+# CONDITIONAL_FLOOR in lisa-run-gates.mjs. This one has no such counterpart:
+# `threshold-monotonicity` is push-onward and compares against HEAD^, while
+# this compares the STAGED change. Leaving it inside the handover would let a
+# complete gates block delete it at commit with nothing put in its place, which
+# is precisely the deletion-by-omission the floor exists to prevent.
 if [ -f "scripts/check-threshold-ratchet.mjs" ] && command -v node >/dev/null 2>&1; then
   echo "📐 Checking threshold ratchet..."
   node scripts/check-threshold-ratchet.mjs --staged
@@ -125,24 +254,4 @@ if [ -f "scripts/check-threshold-ratchet.mjs" ] && command -v node >/dev/null 2>
     exit 1
   fi
 fi
-
-# Run lint-staged for incremental lint and format checks
-echo "🚀 Running lint-staged..."
-$EXECUTOR lint-staged --config .lintstagedrc.json
-LINT_STAGED_STATUS=$?
-if [ $LINT_STAGED_STATUS -ne 0 ]; then
-  exit $LINT_STAGED_STATUS
-fi
-
-# Generated artifacts must vouch for the bytes committed beside them. Runs AFTER
-# lint-staged on purpose: reformatting a staged template moves its bytes, so a
-# check placed above would sign off on bytes that no longer exist. Absent in host
-# projects, which have the hook but none of Lisa's generators.
-if [ -f "scripts/check-derived-artifacts.mjs" ] && command -v node >/dev/null 2>&1; then
-  echo "🧾 Checking generated artifacts..."
-  node scripts/check-derived-artifacts.mjs --staged
-  if [ $? -ne 0 ]; then
-    exit 1
-  fi
-fi
 # END: AI GUARDRAILS

package/typescript/copy-contents/.husky/pre-push

@@ -38,21 +38,100 @@ fi
 
 echo "📦 Using package manager: $PACKAGE_MANAGER"
 
+# ---------------------------------------------------------------------------
+# Gate-driven checks. See the matching block in .husky/pre-commit for the full
+# contract; the exit-code routing is identical, at the `push` moment.
+#
+#   exit 0  → the declared gates at this moment ran and none of them blocked.
+#   exit 1  → a required gate FAILED. Block the push.
+#   exit 78 → there is no `gates` block at all. Nothing is covered.
+#   other   → the runner itself could not run. Nothing was proved. Say so
+#             loudly and cover nothing.
+#
+# ONE STEP AT A TIME, NOT ALL OR NOTHING. Exit 0 says the declared gates
+# passed, not that the registry covers every property the steps below prove, so
+# it cannot be the thing that skips them wholesale. The runner writes the
+# properties it covers into $LISA_GATE_COVERAGE and each step stands down only
+# against its own. Fail-safe: no file, an empty file, a runner that could not
+# run, or no exact match all mean the built-in step runs.
+#
+# The project-specific extension slots at the bottom of this file run either
+# way — they are project behaviour, not registry gates.
+# ---------------------------------------------------------------------------
+GATE_RUNNER="scripts/lisa-run-gates.mjs"
+if [ ! -f "$GATE_RUNNER" ]; then
+  GATE_RUNNER="all/copy-overwrite/scripts/lisa-run-gates.mjs"
+fi
+LISA_GATE_COVERAGE=""
+if [ -f "$GATE_RUNNER" ] && command -v node >/dev/null 2>&1; then
+  LISA_GATE_COVERAGE="$(mktemp "${TMPDIR:-/tmp}/lisa-gate-coverage.XXXXXXXX")" || LISA_GATE_COVERAGE=""
+  trap 'rm -f "$LISA_GATE_COVERAGE"' EXIT
+  if [ -n "$LISA_GATE_COVERAGE" ]; then
+    node "$GATE_RUNNER" --moment=push --coverage="$LISA_GATE_COVERAGE"
+  else
+    # No temp file, so nothing can be covered and every built-in step runs.
+    node "$GATE_RUNNER" --moment=push
+  fi
+  GATE_STATUS=$?
+  if [ $GATE_STATUS -eq 1 ]; then
+    echo ""
+    echo "❌ Push blocked: a required gate failed. See the FAILED line above."
+    echo ""
+    exit 1
+  fi
+  if [ $GATE_STATUS -ne 0 ]; then
+    # Coverage from a run that did not finish is not evidence.
+    if [ -n "$LISA_GATE_COVERAGE" ]; then
+      : > "$LISA_GATE_COVERAGE"
+    fi
+    if [ $GATE_STATUS -ne 78 ]; then
+      echo ""
+      echo "⚠️  The gate runner could not run (exit $GATE_STATUS)."
+      echo "   Nothing was proved by the gate registry — this is NOT a pass."
+      echo "   Running the built-in checks instead."
+      echo ""
+    fi
+  fi
+else
+  echo "ℹ️  Gate runner unavailable; running the built-in checks."
+fi
+
+# Whether a declared gate covers every property named, so the built-in step
+# that proves them can stand down. Exact whole-line matching: a gate id that is
+# a prefix of another must never satisfy it.
+lisa_gate_covers() {
+  [ -n "$LISA_GATE_COVERAGE" ] || return 1
+  [ -s "$LISA_GATE_COVERAGE" ] || return 1
+  for _lisa_gate in "$@"; do
+    grep -Fqx -- "$_lisa_gate" "$LISA_GATE_COVERAGE" || return 1
+  done
+  return 0
+}
+
+# BEGIN: built-in checks — the pre-registry path, kept step for step so a
+# project without a `gates` block behaves exactly as it did before.
+
 # Run the whole-project type check once before code leaves the machine. It is
 # intentionally not a pre-commit gate because TypeScript cannot check only the
 # staged files and rebuilding the full program makes small commits too slow.
-echo "🔍 Running type check..."
-$RUNNER typecheck
-if [ $? -ne 0 ]; then
-  echo "❌ Type check failed. Please fix TypeScript errors before pushing."
-  exit 1
+if lisa_gate_covers type-correctness; then
+  echo "ℹ️  Covered by the type-correctness gate; the built-in type check stands down."
+else
+  echo "🔍 Running type check..."
+  $RUNNER typecheck
+  if [ $? -ne 0 ]; then
+    echo "❌ Type check failed. Please fix TypeScript errors before pushing."
+    exit 1
+  fi
 fi
 
 # Run security audit
 echo "🔒 Running security audit..."
 
 # jq is required for all audit paths (JSON config reading, npm/yarn filtering)
-if ! command -v jq >/dev/null 2>&1; then
+if lisa_gate_covers dependency-vulnerability; then
+  echo "ℹ️  Covered by the dependency-vulnerability gate; the built-in audit stands down."
+elif ! command -v jq >/dev/null 2>&1; then
   echo ""
   echo "⚠️  WARNING: jq is not installed - required for security audit"
   echo ""
@@ -179,7 +258,79 @@ else
     # devDependencies too and the gate fails on dev-only CVEs that never ship —
     # the SE-5221 false positive. bun honours `--production` even though
     # `bun audit --help` omits it from the flag list.
-    AUDIT_JSON=$(bun audit --production --json 2>/dev/null || true)
+    # Normalize bun's transport before parsing, or this gate FAILS OPEN.
+    #
+    # Measured: bun can return gzip-compressed JSON on stdout while reporting a
+    # parse error on stderr. The previous single-line form captured that binary
+    # into AUDIT_JSON, the jq filter below then failed, UNFIXED_HIGH came back
+    # empty, UNFIXED_COUNT resolved to empty, `-gt 0` was false, and the hook
+    # printed "No high or critical vulnerabilities found" and allowed the push.
+    # A security gate reporting success having parsed nothing.
+    #
+    # Lisa's own .husky/pre-push was patched for this; this shipped copy was
+    # not, so every host project on this template carried the fail-open. Keep
+    # the two in step — two copies of one check cannot be kept aligned by
+    # intention, which is exactly how this drifted.
+    # Every path out of this block either parses advisory data or blocks the
+    # push. The gzip branch below handles the transport shape that was measured;
+    # it cannot be the only one handled, because "some other unparseable shape"
+    # is precisely the case nobody has seen yet. An audit whose payload was
+    # never parsed has audited nothing, and printing "no vulnerabilities found"
+    # from that state is the fail-open this whole block exists to remove.
+    #
+    # This hook does not run under `set -e`, so an unguarded mktemp would leave
+    # the path empty, the redirect would fail, and `[ ! -s "" ]` would be true —
+    # a clean verdict from a file that was never written. Same rule the
+    # pre-commit gitleaks scan states: a degraded security check is worse than a
+    # blocked push.
+    if ! AUDIT_OUTPUT="$(mktemp "${TMPDIR:-/tmp}/bun-audit.XXXXXXXX")" || [ -z "$AUDIT_OUTPUT" ]; then
+      echo "❌ Push blocked: could not create a temporary file for the security audit." >&2
+      echo "   Check that TMPDIR (${TMPDIR:-/tmp}) exists and is writable." >&2
+      exit 1
+    fi
+    if ! AUDIT_STDERR="$(mktemp "${TMPDIR:-/tmp}/bun-audit-err.XXXXXXXX")" || [ -z "$AUDIT_STDERR" ]; then
+      rm -f "$AUDIT_OUTPUT"
+      echo "❌ Push blocked: could not create a temporary file for the security audit." >&2
+      echo "   Check that TMPDIR (${TMPDIR:-/tmp}) exists and is writable." >&2
+      exit 1
+    fi
+    # bun's own diagnostics are kept rather than discarded. "Lockfile not found"
+    # is the difference between a broken audit and a clean one, and throwing it
+    # away is how a failed command comes to read as a measured zero.
+    bun audit --production --json > "$AUDIT_OUTPUT" 2>"$AUDIT_STDERR" || true
+    if [ ! -s "$AUDIT_OUTPUT" ]; then
+      echo "❌ Push blocked: bun audit produced no output, so nothing was audited." >&2
+      echo "   This is NOT a clean result — a clean audit prints JSON ({} when" >&2
+      echo "   there are no advisories). Empty output means the audit did not run." >&2
+      if [ -s "$AUDIT_STDERR" ]; then
+        echo "   bun said:" >&2
+        sed 's/^/     /' "$AUDIT_STDERR" >&2
+      fi
+      rm -f "$AUDIT_OUTPUT" "$AUDIT_STDERR"
+      exit 1
+    elif jq empty "$AUDIT_OUTPUT" >/dev/null 2>&1; then
+      AUDIT_JSON=$(cat "$AUDIT_OUTPUT")
+    else
+      DECOMPRESSED_AUDIT_OUTPUT="$(mktemp "${TMPDIR:-/tmp}/bun-audit-gz.XXXXXXXX")"
+      if [ -n "$DECOMPRESSED_AUDIT_OUTPUT" ]; then
+        gzip -dc "$AUDIT_OUTPUT" > "$DECOMPRESSED_AUDIT_OUTPUT" 2>/dev/null || true
+      fi
+      # `-s` before `jq empty`: an EMPTY file passes `jq empty` (no input is
+      # not invalid input), so a gunzip that failed and wrote nothing would be
+      # accepted as valid JSON and set AUDIT_JSON to the empty string.
+      if [ -s "$DECOMPRESSED_AUDIT_OUTPUT" ] && jq empty "$DECOMPRESSED_AUDIT_OUTPUT" >/dev/null 2>&1; then
+        AUDIT_JSON=$(cat "$DECOMPRESSED_AUDIT_OUTPUT")
+        rm -f "$DECOMPRESSED_AUDIT_OUTPUT"
+      else
+        rm -f "$DECOMPRESSED_AUDIT_OUTPUT" "$AUDIT_OUTPUT" "$AUDIT_STDERR"
+        echo "❌ Push blocked: bun audit output is neither JSON nor gzipped JSON," >&2
+        echo "   so no advisory data was parsed and nothing was audited." >&2
+        echo "   This is NOT a clean result. Re-run 'bun audit --production --json'" >&2
+        echo "   to see what it emitted." >&2
+        exit 1
+      fi
+    fi
+    rm -f "$AUDIT_OUTPUT" "$AUDIT_STDERR"
     UNFIXED_HIGH=$(echo "$AUDIT_JSON" | jq -r --arg ids "$AUDIT_EXCLUSIONS" '
       ($ids | split(" ") | map(select(length > 0))) as $ex
       | [ .[]? | .[]?
@@ -188,7 +339,18 @@ else
           | select(($ex | index($g)) | not)
           | $g ]
       | unique')
-    UNFIXED_COUNT=$(echo "$UNFIXED_HIGH" | jq -r 'length' 2>/dev/null || echo 0)
+    # A count that could not be computed is not a count of zero. The old `|| echo
+    # 0` turned a jq filter that errored — an audit whose JSON shape this hook
+    # does not understand — into "no vulnerabilities found", which is the same
+    # fail-open as the transport hole above, one step further down.
+    UNFIXED_COUNT=$(echo "$UNFIXED_HIGH" | jq -r 'length' 2>/dev/null || echo "")
+    if [ -z "$UNFIXED_COUNT" ]; then
+      echo "❌ Push blocked: the audit payload parsed, but the advisory filter" >&2
+      echo "   produced no count, so no advisory was evaluated." >&2
+      echo "   This is NOT a clean result. Re-run 'bun audit --production --json'" >&2
+      echo "   to see the shape it returned." >&2
+      exit 1
+    fi
     if [ "$UNFIXED_COUNT" -gt 0 ]; then
       echo "⚠️ Security audit failed. Unresolved high/critical advisories in production dependencies:"
       echo "$UNFIXED_HIGH" | jq -r '.[]'
@@ -200,7 +362,9 @@ else
 fi
 
 # Run slow lint rules - only if script exists
-if jq -e '.scripts["lint:slow"]' package.json >/dev/null 2>&1; then
+if lisa_gate_covers code-style-slow; then
+  echo "ℹ️  Covered by the code-style-slow gate; the built-in slow lint stands down."
+elif jq -e '.scripts["lint:slow"]' package.json >/dev/null 2>&1; then
   echo "🐢 Running slow lint rules..."
   $RUNNER lint:slow
   if [ $? -ne 0 ]; then
@@ -223,7 +387,9 @@ else
   KNIP_SCRIPT=""
 fi
 
-if [ -n "$KNIP_SCRIPT" ]; then
+if lisa_gate_covers dead-code; then
+  echo "ℹ️  Covered by the dead-code gate; the built-in knip run stands down."
+elif [ -n "$KNIP_SCRIPT" ]; then
   echo "🗑️ Running dead code detection (knip)..."
   $RUNNER "$KNIP_SCRIPT"
   if [ $? -ne 0 ]; then
@@ -237,20 +403,30 @@ else
   echo "ℹ️  Skipping dead code detection (knip not configured)"
 fi
 
-# Run unit tests with coverage
-echo "🧪 Running unit tests with coverage..."
-$RUNNER test:cov
-if [ $? -ne 0 ]; then
-  echo "❌ Unit tests or coverage thresholds failed. Please fix before pushing."
-  exit 1
+# Run unit tests with coverage. `test:cov` proves two properties in one run —
+# the suite passes AND the coverage thresholds hold — so it stands down only
+# when both have a gate declared.
+if lisa_gate_covers test-correctness coverage-adequacy; then
+  echo "ℹ️  Covered by the test-correctness and coverage-adequacy gates; the built-in run stands down."
+else
+  echo "🧪 Running unit tests with coverage..."
+  $RUNNER test:cov
+  if [ $? -ne 0 ]; then
+    echo "❌ Unit tests or coverage thresholds failed. Please fix before pushing."
+    exit 1
+  fi
 fi
 
 # Run integration tests
-echo "🧪 Running integration tests..."
-$RUNNER test:integration
-if [ $? -ne 0 ]; then
-  echo "❌ Integration tests failed. Please fix failing tests before pushing."
-  exit 1
+if lisa_gate_covers test-integration; then
+  echo "ℹ️  Covered by the test-integration gate; the built-in run stands down."
+else
+  echo "🧪 Running integration tests..."
+  $RUNNER test:integration
+  if [ $? -ne 0 ]; then
+    echo "❌ Integration tests failed. Please fix failing tests before pushing."
+    exit 1
+  fi
 fi
 
 # Run mutation-testing gate - only if script exists.
@@ -258,7 +434,9 @@ fi
 # (mutation.gate.json: "enabled": false), so this adds no cost to projects that
 # have not opted in. When enabled, it runs Stryker diff-only on changed files
 # and fails the push when the mutation score is below thresholds.break.
-if jq -e '.scripts["test:mutation"]' package.json >/dev/null 2>&1; then
+if lisa_gate_covers test-meaningfulness; then
+  echo "ℹ️  Covered by the test-meaningfulness gate; the built-in run stands down."
+elif jq -e '.scripts["test:mutation"]' package.json >/dev/null 2>&1; then
   echo "🧬 Running mutation-testing gate..."
   $RUNNER test:mutation
   if [ $? -ne 0 ]; then
@@ -337,6 +515,8 @@ fi
 #   fi
 # fi
 
+# END: built-in checks
+
 # Managed verification (UAT) extension slot (see .husky/pre-push.verify).
 # Opt-in project types (e.g. phaser) ship this snippet via Lisa; it mirrors the
 # CI verification_coverage gate locally. It is absent for types that have not