@codyswann/lisa 3.31.4 → 3.32.0

package/dist/core/downstream-references.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Detect references to downstream host projects in this repository's own files.
+ *
+ * Projects may mention Lisa; Lisa may not mention projects. This repository is
+ * public and `dist/` is in the npm `files` allowlist, so a comment in `src/` is
+ * published twice — on github.com and to every consumer that installs.
+ *
+ * **Shape detection, not a name list.** A guard that enumerated the client
+ * names would publish the very list it exists to protect, in the same public
+ * repository. So this allowlists the orgs that are legitimately public and
+ * flags everything else, which also means a NEW downstream project is caught
+ * without anyone remembering to add it.
+ * @module core/downstream-references
+ */
+/**
+ * GitHub orgs this repository may legitimately name.
+ *
+ * Lisa's own org, the platforms it integrates with, and the vendors whose
+ * actions and packages it pins. Anything outside this set is treated as a host
+ * project until someone deliberately says otherwise.
+ */
+export declare const PUBLIC_ORGS: readonly string[];
+/**
+ * Owners that are obviously stand-ins rather than real accounts.
+ *
+ * Documentation needs a worked example, and refusing one would push authors
+ * toward using a real name instead — the opposite of the intent.
+ */
+export declare const PLACEHOLDER_OWNERS: readonly string[];
+/**
+ * AWS account ids that are documentation placeholders rather than real ones.
+ *
+ * AWS's own docs use `123456789012`; the repeated-digit forms are unmistakably
+ * synthetic. Any other 12-digit account id in an ARN is treated as real.
+ */
+export declare const PLACEHOLDER_ACCOUNTS: readonly string[];
+/** One detected reference, with enough context to act on it. */
+export interface DownstreamReference {
+    /** 1-indexed line number. */
+    readonly line: number;
+    /** What was matched. */
+    readonly match: string;
+    /** Why it is a violation. */
+    readonly reason: string;
+}
+/**
+ * Find downstream-project references in one file's contents.
+ * @param contents - The file's text.
+ * @returns Every violation found, in line order.
+ */
+export declare function findDownstreamReferences(contents: string): readonly DownstreamReference[];
+//# sourceMappingURL=downstream-references.d.ts.map

package/dist/core/downstream-references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"downstream-references.d.ts","sourceRoot":"","sources":["../../src/core/downstream-references.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAqExC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAqB/C,CAAC;AA2BF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EASjD,CAAC;AAEF,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wBAAwB;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAoED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,GACf,SAAS,mBAAmB,EAAE,CAOhC"}

package/dist/core/downstream-references.js

@@ -0,0 +1,227 @@
+/**
+ * Detect references to downstream host projects in this repository's own files.
+ *
+ * Projects may mention Lisa; Lisa may not mention projects. This repository is
+ * public and `dist/` is in the npm `files` allowlist, so a comment in `src/` is
+ * published twice — on github.com and to every consumer that installs.
+ *
+ * **Shape detection, not a name list.** A guard that enumerated the client
+ * names would publish the very list it exists to protect, in the same public
+ * repository. So this allowlists the orgs that are legitimately public and
+ * flags everything else, which also means a NEW downstream project is caught
+ * without anyone remembering to add it.
+ * @module core/downstream-references
+ */
+/**
+ * GitHub orgs this repository may legitimately name.
+ *
+ * Lisa's own org, the platforms it integrates with, and the vendors whose
+ * actions and packages it pins. Anything outside this set is treated as a host
+ * project until someone deliberately says otherwise.
+ */
+export const PUBLIC_ORGS = [
+    "codyswanngt",
+    "actions",
+    "github",
+    "anthropics",
+    "openai",
+    "oven-sh",
+    "microsoft",
+    "facebook",
+    "vercel",
+    "expo",
+    "mobile-dev-inc",
+    "coderabbitai",
+    "getsentry",
+    "snyk",
+    "sonarsource",
+    "gitguardian",
+    "aws",
+    "aws-actions",
+    "docker",
+    "denoland",
+    "nodejs",
+    "npm",
+    "pnpm",
+    "yarnpkg",
+    "eslint",
+    "prettier",
+    "vitest-dev",
+    "jestjs",
+    "typescript-eslint",
+    "biomejs",
+    "astral-sh",
+    "peter-evans",
+    "dependabot",
+    "renovatebot",
+    "fossas",
+    "zaproxy",
+    "softprops",
+    "reactivecircus",
+    "webfactory",
+    "slsa-framework",
+    "hashicorp",
+    "chinthakagodawita",
+    "browser-actions",
+    "googlechrome",
+    "geowerkstatt",
+    "ibm",
+    "lopopolo",
+    "canastro",
+    "numman-ali",
+    "ankitpokhrel",
+    "enquirer",
+    "oxc-project",
+    "pypa",
+    "bats-core",
+    "jprichardson",
+    "mbj",
+    "steveyegge",
+    "eyaltoledano",
+    "piebald-ai",
+    "gitleaks",
+    "ruby",
+    "grafana",
+    "cli",
+    "bitwarden",
+    "import-js",
+    "evanbacon",
+    "stretchr",
+    "noliran",
+];
+/**
+ * Owners that are obviously stand-ins rather than real accounts.
+ *
+ * Documentation needs a worked example, and refusing one would push authors
+ * toward using a real name instead — the opposite of the intent.
+ */
+export const PLACEHOLDER_OWNERS = [
+    "your_username",
+    "your-org",
+    "yourorg",
+    "owner",
+    "org",
+    "example",
+    "example-org",
+    "acme",
+    "acmeorga",
+    "acmeorgb",
+    "acmeorgc",
+    "acmeorgd",
+    "acme-secret-customer",
+    "someone",
+    "somebody",
+    "vendor",
+    "urlorg",
+    "host",
+    "myorg",
+    "o",
+];
+/**
+ * URL path segments that precede the owner rather than being it.
+ *
+ * `api.github.com/repos/<owner>/<repo>` and `github.com/orgs/<org>` both put a
+ * fixed word where the owner would otherwise sit.
+ */
+const NOT_AN_OWNER = [
+    "repos",
+    "orgs",
+    "users",
+    "packages",
+    "advisories",
+    "search",
+    "gists",
+    "apps",
+    "en",
+    "private",
+    "public",
+    "settings",
+    "notifications",
+    "sponsors",
+    "features",
+    "pricing",
+];
+/**
+ * AWS account ids that are documentation placeholders rather than real ones.
+ *
+ * AWS's own docs use `123456789012`; the repeated-digit forms are unmistakably
+ * synthetic. Any other 12-digit account id in an ARN is treated as real.
+ */
+export const PLACEHOLDER_ACCOUNTS = [
+    "123456789012",
+    "210987654321",
+    "345678901234",
+    "456789012345",
+    "111111111111",
+    "222222222222",
+    "333333333333",
+    "000000000000",
+];
+// `owner/repo` as it appears in a URL or a workflow `uses:`. Deliberately not
+// matching bare `a/b` anywhere in prose: that shape collides with file paths,
+// date fractions and option syntax, and a guard with false positives gets
+// disabled, which is worse than a guard with a known blind spot.
+const OWNER_REPO = /(?:github\.com[/:]|uses:\s*)([A-Za-z0-9][\w.-]*)\/([\w.-]+)/gu;
+/**
+ * Whether a captured owner is something other than a real account name.
+ *
+ * @param owner - The lowercased first path segment.
+ * @returns True when it must not be treated as an org.
+ */
+function isNotAnOwner(owner) {
+    // A port (`git@github.com:22/...`) captures as digits.
+    if (/^\d+$/u.test(owner)) {
+        return true;
+    }
+    return NOT_AN_OWNER.includes(owner) || PLACEHOLDER_OWNERS.includes(owner);
+}
+const ARN_ACCOUNT = /arn:aws:[a-z0-9-]*:[a-z0-9-]*:(\d{12})/gu;
+const SSO_ACCOUNT = /sso_account_id\s*=\s*(\d{12})/gu;
+/**
+ * Owner/repo references on one line that name a non-public org.
+ * @param text - The line's text.
+ * @param line - 1-indexed line number.
+ * @returns Violations on this line.
+ */
+function ownerViolations(text, line) {
+    return [...text.matchAll(OWNER_REPO)]
+        .filter(match => {
+        const org = (match[1] ?? "").toLowerCase();
+        return org !== "" && !PUBLIC_ORGS.includes(org) && !isNotAnOwner(org);
+    })
+        .map(match => ({
+        line,
+        match: `${match[1]}/${match[2]}`,
+        reason: `"${match[1]}" is not an allowlisted public org — Lisa must not name a downstream project`,
+    }));
+}
+/**
+ * Real-looking AWS account ids on one line.
+ * @param text - The line's text.
+ * @param line - 1-indexed line number.
+ * @returns Violations on this line.
+ */
+function accountViolations(text, line) {
+    return [ARN_ACCOUNT, SSO_ACCOUNT]
+        .flatMap(pattern => [...text.matchAll(pattern)])
+        .filter(match => !PLACEHOLDER_ACCOUNTS.includes(match[1] ?? ""))
+        .map(match => ({
+        line,
+        match: match[1] ?? "",
+        reason: "a real-looking AWS account id — use a documentation placeholder",
+    }));
+}
+/**
+ * Find downstream-project references in one file's contents.
+ * @param contents - The file's text.
+ * @returns Every violation found, in line order.
+ */
+export function findDownstreamReferences(contents) {
+    return contents
+        .split("\n")
+        .flatMap((text, index) => [
+        ...ownerViolations(text, index + 1),
+        ...accountViolations(text, index + 1),
+    ]);
+}
+//# sourceMappingURL=downstream-references.js.map

package/dist/core/downstream-references.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"downstream-references.js","sourceRoot":"","sources":["../../src/core/downstream-references.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,aAAa;IACb,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,WAAW;IACX,UAAU;IACV,QAAQ;IACR,MAAM;IACN,gBAAgB;IAChB,cAAc;IACd,WAAW;IACX,MAAM;IACN,aAAa;IACb,aAAa;IACb,KAAK;IACL,aAAa;IACb,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,KAAK;IACL,MAAM;IACN,SAAS;IACT,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,mBAAmB;IACnB,SAAS;IACT,WAAW;IACX,aAAa;IACb,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,SAAS;IACT,WAAW;IACX,gBAAgB;IAChB,YAAY;IACZ,gBAAgB;IAChB,WAAW;IACX,mBAAmB;IACnB,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,KAAK;IACL,UAAU;IACV,UAAU;IACV,YAAY;IACZ,cAAc;IACd,UAAU;IACV,aAAa;IACb,MAAM;IACN,WAAW;IACX,cAAc;IACd,KAAK;IACL,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,UAAU;IACV,MAAM;IACN,SAAS;IACT,KAAK;IACL,WAAW;IACX,WAAW;IACX,WAAW;IACX,UAAU;IACV,SAAS;CACV,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,eAAe;IACf,UAAU;IACV,SAAS;IACT,OAAO;IACP,KAAK;IACL,SAAS;IACT,aAAa;IACb,MAAM;IACN,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,sBAAsB;IACtB,SAAS;IACT,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,OAAO;IACP,GAAG;CACJ,CAAC;AAEF;;;;;GAKG;AACH,MAAM,YAAY,GAAsB;IACtC,OAAO;IACP,MAAM;IACN,OAAO;IACP,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,MAAM;IACN,IAAI;IACJ,SAAS;IACT,QAAQ;IACR,UAAU;IACV,eAAe;IACf,UAAU;IACV,UAAU;IACV,SAAS;CACV,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;CACf,CAAC;AAYF,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,iEAAiE;AACjE,MAAM,UAAU,GACd,+DAA+D,CAAC;AAElE;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,uDAAuD;IACvD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,WAAW,GAAG,0CAA0C,CAAC;AAC/D,MAAM,WAAW,GAAG,iCAAiC,CAAC;AAEtD;;;;;GAKG;AACH,SAAS,eAAe,CACtB,IAAY,EACZ,IAAY;IAEZ,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC,EAAE;QACd,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC,CAAC;SACD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACb,IAAI;QACJ,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE;QAChC,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,8EAA8E;KACnG,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,IAAY,EACZ,IAAY;IAEZ,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC;SAC9B,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;SAC/C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SAC/D,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACb,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,iEAAiE;KAC1E,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB;IAEhB,OAAO,QAAQ;SACZ,KAAK,CAAC,IAAI,CAAC;SACX,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;QACnC,GAAG,iBAAiB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;KACtC,CAAC,CAAC;AACP,CAAC"}

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA00EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAkrOjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA00EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAqrOjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -1192,6 +1192,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
 });
 /** Exact paths tracked by the public Lisa repository at generation time. */
 export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
+    ".agents/rules/never-name-downstream-projects.md": true,
     ".agents/skills/claude-code-action/SKILL.md": true,
     ".agents/skills/claude-code-action/references/inputs.md": true,
     ".agents/skills/harness-parity-council/SKILL.md": true,
@@ -7186,6 +7187,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/core/apply-receipt.ts": true,
     "src/core/bootstrap-environment.ts": true,
     "src/core/config.ts": true,
+    "src/core/downstream-references.ts": true,
     "src/core/git-service.ts": true,
     "src/core/guard-capabilities.ts": true,
     "src/core/host-rules-pointer.ts": true,
@@ -7702,6 +7704,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/core/lisa-owned-templates.test.ts": true,
     "tests/unit/core/lisa-plugin-selection.test.ts": true,
     "tests/unit/core/lisa-skill-sources.test.ts": true,
+    "tests/unit/core/no-downstream-project-names.test.ts": true,
     "tests/unit/core/plugin-sync-marker.test.ts": true,
     "tests/unit/core/project-config-harness-migration.test.ts": true,
     "tests/unit/core/project-config-kane.test.ts": true,