@codyswann/lisa 3.33.5 → 3.33.7

package/scripts/plugin-parity-drift.mjs

@@ -44,17 +44,31 @@ import { fileURLToPath } from "node:url";
 
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
+// Literals named once — each was repeated enough times that a typo in one
+// copy would diverge silently.
+const NOT_INSTALLED = "not-installed";
+
 const REPO_ROOT = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
   ".."
 );
 
 /**
- * Semver 2.0.0 grammar. Build metadata (`+...`) is accepted but ignored in
- * comparison; prerelease (`-...`) is accepted and sorts below its release.
+ * Semver 2.0.0 grammar, one clause per name. Build metadata (`+...`) is
+ * accepted but ignored in comparison; prerelease (`-...`) is accepted and sorts
+ * below its release.
+ *
+ * Assembled from fragments rather than written as one literal because the
+ * literal was unreadable — this is the semver.org grammar verbatim, and the
+ * composed `.source` is byte-identical to the literal it replaced.
  */
-const SEMVER_RE =
-  /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+const SEMVER_NUMERIC = "0|[1-9]\\d*";
+const SEMVER_PRERELEASE_ID = `(?:${SEMVER_NUMERIC}|\\d*[A-Za-z-][0-9A-Za-z-]*)`;
+const SEMVER_PRERELEASE = `(?:-(${SEMVER_PRERELEASE_ID}(?:\\.${SEMVER_PRERELEASE_ID})*))?`;
+const SEMVER_BUILD = "(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?";
+const SEMVER_RE = new RegExp(
+  `^(${SEMVER_NUMERIC})\\.(${SEMVER_NUMERIC})\\.(${SEMVER_NUMERIC})${SEMVER_PRERELEASE}${SEMVER_BUILD}$`
+);
 
 /** A plugin name / marketplace token: `1*(ALPHA / DIGIT / "-" / "_")`. */
 const TOKEN_RE = /^[A-Za-z0-9_-]+$/;
@@ -283,11 +297,11 @@ export function resolveCurrentVersion(cacheRoot, name, marketplace) {
   // enforces this, but resolveCurrentVersion is a public export that no longer
   // co-locates with its validating caller.
   if (!TOKEN_RE.test(name) || !TOKEN_RE.test(marketplace)) {
-    return { status: "not-installed", version: null };
+    return { status: NOT_INSTALLED, version: null };
   }
   const dir = path.join(cacheRoot, marketplace, name);
   if (!isDirectory(dir)) {
-    return { status: "not-installed", version: null };
+    return { status: NOT_INSTALLED, version: null };
   }
   const versions = [];
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
@@ -308,8 +322,12 @@ export function resolveCurrentVersion(cacheRoot, name, marketplace) {
   if (versions.length === 0) {
     return { status: "unresolved", version: null };
   }
-  const max = versions.reduce((acc, v) =>
-    compareSemver(v, acc) > 0 ? v : acc
+  // `versions` is non-empty (guarded above), so seeding with the first element
+  // is exactly what the no-seed form did — and it cannot throw if that guard is
+  // ever moved.
+  const max = versions.reduce(
+    (acc, v) => (compareSemver(v, acc) > 0 ? v : acc),
+    versions[0]
   );
   return { status: "ok", version: max };
 }
@@ -323,8 +341,8 @@ export function resolveCurrentVersion(cacheRoot, name, marketplace) {
  * @returns {"ok" | "stale" | "ahead" | "not-installed" | "unresolved"} the status.
  */
 export function classify(pinnedVersion, cur) {
-  if (cur.status === "not-installed") {
-    return "not-installed";
+  if (cur.status === NOT_INSTALLED) {
+    return NOT_INSTALLED;
   }
   // Defense-in-depth: any non-`ok` resolver state, or an `ok` state without a
   // string version, is treated as `unresolved` so compareSemver is never called
@@ -550,9 +568,7 @@ function collectSyncedSkills(roots) {
  * @returns {void}
  */
 function emitReport(out, report, json) {
-  out.write(
-    (json ? JSON.stringify(report, null, 2) : humanTable(report)) + "\n"
-  );
+  out.write(`${json ? JSON.stringify(report, null, 2) : humanTable(report)}\n`);
 }
 
 /**

package/scripts/plugin-routing-validate.mjs

@@ -152,7 +152,13 @@ export function cacheMaxVersion(cacheRoot, name, marketplace) {
   if (versions.length === 0) {
     return null;
   }
-  return versions.reduce((acc, v) => (compareSemver(v, acc) > 0 ? v : acc));
+  // `versions` is non-empty (guarded above), so seeding with the first element
+  // is exactly what the no-seed form did — and it cannot throw if that guard is
+  // ever moved.
+  return versions.reduce(
+    (acc, v) => (compareSemver(v, acc) > 0 ? v : acc),
+    versions[0]
+  );
 }
 
 /**
@@ -553,7 +559,7 @@ function humanReport(report) {
  */
 function emitReport(out, report, json) {
   out.write(
-    (json ? JSON.stringify(report, null, 2) : humanReport(report)) + "\n"
+    `${json ? JSON.stringify(report, null, 2) : humanReport(report)}\n`
   );
 }
 

package/scripts/update-node-version.ts

@@ -18,6 +18,10 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 
+// Literals named once — each was repeated enough times that a typo in one
+// copy would diverge silently.
+const VERSION_REPLACEMENT = "$1{{version}}$2";
+
 const PROJECT_ROOT = path.resolve(import.meta.dirname, "..");
 
 /**
@@ -34,12 +38,12 @@ const WORKFLOW_PATTERNS: readonly ReplacementPattern[] = [
   // node_version: '22.21.1' (workflow input defaults)
   {
     pattern: /(node_version:\s*['"])[\d.]+(['"])/g,
-    replacement: "$1{{version}}$2",
+    replacement: VERSION_REPLACEMENT,
   },
   // node-version: '22.21.1' (actions/setup-node)
   {
     pattern: /(node-version:\s*['"])[\d.]+(['"])/g,
-    replacement: "$1{{version}}$2",
+    replacement: VERSION_REPLACEMENT,
   },
   // node-version: '22.x' (major version pattern)
   {
@@ -50,7 +54,7 @@ const WORKFLOW_PATTERNS: readonly ReplacementPattern[] = [
 
 const PACKAGE_JSON_PATTERN: ReplacementPattern = {
   pattern: /("node":\s*["'])[\d.]+(["'])/g,
-  replacement: "$1{{version}}$2",
+  replacement: VERSION_REPLACEMENT,
 };
 
 /**

package/scripts/verify-health-agentic-built.mjs

@@ -17,6 +17,14 @@ import {
 import { tmpdir } from "node:os";
 import path from "node:path";
 
+// Literals named once — each was repeated enough times that a typo in one
+// copy would diverge silently.
+const TEMPLATES_MANAGED = "templates.managed";
+const AGENTIC_CI_SKIP_LINT = "agentic.ci.skip.lint";
+const ESLINT_CONFIG_TS = "eslint.config.ts";
+const AGENTIC_INTENTIONAL_DRIFT = "agentic.intentional-drift";
+const HARPER_APP = "harper-app";
+
 let assertions = 0;
 const check = (condition, message) => {
   assertions += 1;
@@ -241,8 +249,7 @@ function artifactEvaluator(request, signal) {
   const mutationDisabled =
     request.config.quality.mutation.gate.enabled === false;
   const managedDrift = request.deterministicFindings.find(
-    finding =>
-      finding.check === "templates.managed" && finding.status === "fail"
+    finding => finding.check === TEMPLATES_MANAGED && finding.status === "fail"
   );
 
   if (mutationDisabled) {
@@ -268,19 +275,19 @@ function artifactEvaluator(request, signal) {
       !/\b(?:reason|justification)\b/iu.test(workflow.content)
     ) {
       judgments.push({
-        check: "agentic.ci.skip.lint",
+        check: AGENTIC_CI_SKIP_LINT,
         reason: `${workflow.path} skips lint without a recorded justification.`,
       });
     }
   }
   if (
-    managedDrift?.reason.includes("eslint.config.ts") === true &&
+    managedDrift?.reason.includes(ESLINT_CONFIG_TS) === true &&
     /\b(?:reason|justification)\b/iu.test(override?.content ?? "") &&
     managedArtifact?.content.includes("no-explicit-any") === true &&
     /["']off["']/u.test(managedArtifact.content)
   ) {
     judgments.push({
-      check: "agentic.intentional-drift",
+      check: AGENTIC_INTENTIONAL_DRIFT,
       reason:
         "The bounded managed ESLint drift disables no-explicit-any despite the recorded temporary justification.",
     });
@@ -316,13 +323,13 @@ try {
       2
     )}\n`
   );
-  await mkdir(path.join(project, "harper-app"), { recursive: true });
+  await mkdir(path.join(project, HARPER_APP), { recursive: true });
   await writeFile(
-    path.join(project, "harper-app", "config.yaml"),
+    path.join(project, HARPER_APP, "config.yaml"),
     "graphqlSchema: ./schema.graphql\njsResource: true\nstatic: ./web\n"
   );
   await writeFile(
-    path.join(project, "harper-app", "schema.graphql"),
+    path.join(project, HARPER_APP, "schema.graphql"),
     "type Query { health: Boolean! }\n"
   );
   git("init", "--initial-branch=main");
@@ -525,7 +532,7 @@ try {
   check(
     unreasonedSkip.findings.some(
       finding =>
-        finding.check === "agentic.ci.skip.lint" &&
+        finding.check === AGENTIC_CI_SKIP_LINT &&
         finding.reason.includes("ci.yml")
     ),
     "unreasoned skipped job produces a named warning"
@@ -545,22 +552,22 @@ try {
   );
   check(
     !reasonedSkip.findings.some(
-      finding => finding.check === "agentic.ci.skip.lint"
+      finding => finding.check === AGENTIC_CI_SKIP_LINT
     ),
     "recorded skip justification clears the job warning"
   );
   printStateDump("skipped-job-reason-clears", {
     undocumented: unreasonedSkip.findings
-      .filter(finding => finding.check === "agentic.ci.skip.lint")
+      .filter(finding => finding.check === AGENTIC_CI_SKIP_LINT)
       .map(findingState),
     documented: reasonedSkip.findings
-      .filter(finding => finding.check === "agentic.ci.skip.lint")
+      .filter(finding => finding.check === AGENTIC_CI_SKIP_LINT)
       .map(findingState),
   });
   console.log("[EVIDENCE: state-dump: skipped-job-reason-clears]");
   await writeFile(ciPath, ciOriginal);
 
-  const managedEslintPath = path.join(project, "eslint.config.ts");
+  const managedEslintPath = path.join(project, ESLINT_CONFIG_TS);
   const managedEslintOriginal = await readFile(managedEslintPath);
   const managedJustification =
     '// justification: temporary vendor migration\nexport default [{ rules: { "@typescript-eslint/no-explicit-any": "off" } }];\n';
@@ -599,7 +606,7 @@ try {
   );
   equal(
     observedManagedArtifacts.map(artifact => artifact?.path),
-    ["eslint.config.ts", "eslint.config.ts"],
+    [ESLINT_CONFIG_TS, ESLINT_CONFIG_TS],
     "both drift judgments inspect the bounded managed ESLint artifact"
   );
   equal(
@@ -613,18 +620,18 @@ try {
   check(
     benignDrift.findings.some(
       finding =>
-        finding.check === "templates.managed" && finding.status === "fail"
+        finding.check === TEMPLATES_MANAGED && finding.status === "fail"
     ),
     "benign agentic judgment cannot erase deterministic managed drift"
   );
   check(
     !benignDrift.findings.some(
-      finding => finding.check === "agentic.intentional-drift"
+      finding => finding.check === AGENTIC_INTENTIONAL_DRIFT
     ),
     "benign managed content produces no drift judgment"
   );
   const suspiciousDriftWarning = suspiciousDrift.findings.find(
-    finding => finding.check === "agentic.intentional-drift"
+    finding => finding.check === AGENTIC_INTENTIONAL_DRIFT
   );
   equal(
     suspiciousDriftWarning?.status,
@@ -643,7 +650,7 @@ try {
         .update(benignManagedContent)
         .digest("hex"),
       warnings: benignDrift.findings
-        .filter(finding => finding.check === "agentic.intentional-drift")
+        .filter(finding => finding.check === AGENTIC_INTENTIONAL_DRIFT)
         .map(findingState),
     },
     suspicious: {
@@ -651,7 +658,7 @@ try {
         .update(suspiciousManagedContent)
         .digest("hex"),
       warnings: suspiciousDrift.findings
-        .filter(finding => finding.check === "agentic.intentional-drift")
+        .filter(finding => finding.check === AGENTIC_INTENTIONAL_DRIFT)
         .map(findingState),
     },
   });
@@ -678,7 +685,7 @@ try {
       name: "malformed",
       evaluator: async () => ({
         status: "completed",
-        judgments: [{ check: "templates.managed", reason: "collision" }],
+        judgments: [{ check: TEMPLATES_MANAGED, reason: "collision" }],
       }),
       timeoutMs: 1_000,
     },

package/scripts/verify-health-consumer-built.mjs

@@ -14,6 +14,10 @@ import {
 import { tmpdir } from "node:os";
 import path from "node:path";
 
+// Literals named once — each was repeated enough times that a typo in one
+// copy would diverge silently.
+const LATEST_JSON = "latest.json";
+
 let assertions = 0;
 const check = (condition, message) => {
   assertions += 1;
@@ -64,7 +68,7 @@ function runCli(project, argv, input) {
 
 /** Return whether the canonical result exists without throwing on absence. */
 async function resultExists(project) {
-  return lstat(path.join(project, ".lisa", "health", "latest.json"))
+  return lstat(path.join(project, ".lisa", "health", LATEST_JSON))
     .then(() => true)
     .catch(() => false);
 }
@@ -91,14 +95,14 @@ async function prepare(project) {
 
 /** Validate one final CLI result against its exact persisted representation. */
 async function validateFinal(project, stdout, expectedMode) {
-  const resultPath = path.join(project, ".lisa", "health", "latest.json");
+  const resultPath = path.join(project, ".lisa", "health", LATEST_JSON);
   const persisted = await readFile(resultPath, "utf8");
   equal(stdout, persisted, `${expectedMode} stdout equals persisted bytes`);
   const result = JSON.parse(stdout);
   equal(result.mode, expectedMode, `final result is ${expectedMode}`);
   equal(
     (await readdir(path.dirname(resultPath))).sort(),
-    ["latest.json"],
+    [LATEST_JSON],
     "one final result remains with no temporary or lock artifact"
   );
   return result;

package/scripts/verify-health-deterministic-built.mjs

@@ -18,6 +18,14 @@ import {
 import { tmpdir } from "node:os";
 import path from "node:path";
 
+// Literals named once — each was repeated enough times that a typo in one
+// copy would diverge silently.
+const PACKAGE_JSON = "package.json";
+const LISA_CONFIG_JSON = ".lisa.config.json";
+const HARPER_APP = "harper-app";
+const TEMPLATES_MANAGED = "templates.managed";
+const PRETTIERIGNORE = ".prettierignore";
+
 let assertions = 0;
 const check = (condition, message) => {
   assertions += 1;
@@ -149,7 +157,7 @@ try {
   await mkdir(isolatedBin, { recursive: true });
   await symlink(gitExecutable, path.join(isolatedBin, "git"));
   await writeFile(
-    path.join(project, "package.json"),
+    path.join(project, PACKAGE_JSON),
     `${JSON.stringify(
       {
         name: "deterministic-health-fixture",
@@ -161,7 +169,7 @@ try {
     )}\n`
   );
   await writeFile(
-    path.join(project, ".lisa.config.json"),
+    path.join(project, LISA_CONFIG_JSON),
     `${JSON.stringify(
       {
         tracker: "github",
@@ -172,13 +180,13 @@ try {
       2
     )}\n`
   );
-  await mkdir(path.join(project, "harper-app"), { recursive: true });
+  await mkdir(path.join(project, HARPER_APP), { recursive: true });
   await writeFile(
-    path.join(project, "harper-app", "config.yaml"),
+    path.join(project, HARPER_APP, "config.yaml"),
     "graphqlSchema: ./schema.graphql\njsResource: true\nstatic: ./web\n"
   );
   await writeFile(
-    path.join(project, "harper-app", "schema.graphql"),
+    path.join(project, HARPER_APP, "schema.graphql"),
     "type Query { health: Boolean! }\n"
   );
   git("init", "--initial-branch=main");
@@ -220,7 +228,7 @@ try {
     }
   );
   const version = JSON.parse(
-    await readFile(path.join(root, "package.json"), "utf8")
+    await readFile(path.join(root, PACKAGE_JSON), "utf8")
   ).version;
   await writeFile(
     path.join(project, ".claude", ".lisa-plugins-synced"),
@@ -256,13 +264,12 @@ try {
   equal(clean.summary.counts.fail, 0, "clean fixture has zero failures");
   equal(clean.summary.verdict, "in band", "clean fixture is in band");
   equal(
-    clean.findings.find(finding => finding.check === "templates.managed")
-      .status,
+    clean.findings.find(finding => finding.check === TEMPLATES_MANAGED).status,
     "pass",
     "the real TypeScript plus Harper child template stack composes cleanly"
   );
   check(
-    (await readFile(path.join(project, ".prettierignore"), "utf8")).includes(
+    (await readFile(path.join(project, PRETTIERIGNORE), "utf8")).includes(
       "AI GUARDRAILS HARPER-FABRIC"
     ),
     "the real child copy-contents block survives its parent overwrite"
@@ -298,14 +305,14 @@ try {
   );
   await writeFile(callerPath, callerOriginal);
 
-  const prettierPath = path.join(project, ".prettierignore");
+  const prettierPath = path.join(project, PRETTIERIGNORE);
   const prettierOriginal = await readFile(prettierPath);
   await writeFile(path.join(project, ".lisaignore"), ".prettierignore\n");
   await writeFile(prettierPath, "project-owned while ignored\n");
   const ignoredTemplate = await assertPureCollection(health, options);
   equal(
     ignoredTemplate.findings.find(
-      finding => finding.check === "templates.managed"
+      finding => finding.check === TEMPLATES_MANAGED
     ).status,
     "pass",
     "ignored templates are outside Lisa ownership"
@@ -337,9 +344,8 @@ try {
   await writeFile(learningsPath, customLearnings);
   const learningsOwned = await assertPureCollection(health, options);
   equal(
-    learningsOwned.findings.find(
-      finding => finding.check === "templates.managed"
-    ).status,
+    learningsOwned.findings.find(finding => finding.check === TEMPLATES_MANAGED)
+      .status,
     "pass",
     "project learnings remain host-owned after their initial seed"
   );
@@ -396,8 +402,7 @@ try {
   );
   const drift = await assertPureCollection(health, options);
   const managedDrift = drift.findings.filter(
-    finding =>
-      finding.check === "templates.managed" && finding.status === "fail"
+    finding => finding.check === TEMPLATES_MANAGED && finding.status === "fail"
   );
   equal(
     managedDrift.length,
@@ -422,7 +427,7 @@ try {
   console.log("[EVIDENCE: clean-project-in-band]");
   console.log("[EVIDENCE: managed-file-restoration-in-band]");
 
-  const configPath = path.join(project, ".lisa.config.json");
+  const configPath = path.join(project, LISA_CONFIG_JSON);
   const config = JSON.parse(await readFile(configPath, "utf8"));
   delete config.github.repo;
   await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`);
@@ -458,10 +463,10 @@ try {
     const unsafeProject = path.join(workspace, "unsafe-host");
     await mkdir(unsafeProject, { recursive: true });
     await writeFile(
-      path.join(unsafeProject, ".lisa.config.json"),
+      path.join(unsafeProject, LISA_CONFIG_JSON),
       '{"tracker":"github","harness":"codex"}\n'
     );
-    execFileSync("mkfifo", [path.join(unsafeProject, "package.json")]);
+    execFileSync("mkfifo", [path.join(unsafeProject, PACKAGE_JSON)]);
     const unsafeStarted = Date.now();
     const unsafe = await health.runDeterministicHealth(unsafeProject, {
       lisaRoot: root,

package/typescript/copy-overwrite/eslint.ignore.config.json

@@ -72,8 +72,6 @@
     "*.d.ts",
     "esbuild.plugins.js",
 
-    "projects/**/scripts/**",
-    "scripts/**",
 
     "lib/**/*.js",
     "src/lib/**/*.js",

package/typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs

@@ -426,7 +426,9 @@ function validateMatch(match, where) {
     try {
       // No `g` flag, ever: a sticky lastIndex makes repeated .test() calls
       // return alternating answers, which reads as an intermittent gate.
-      void new RegExp(pattern);
+      // Compiling IS the assertion — an invalid pattern throws right here — so
+      // the result is deliberately unused.
+      const _compiled = new RegExp(pattern);
     } catch (error) {
       throw new GateConfigError(
         `${where}: \`match.pattern\` does not compile: ${error instanceof Error ? error.message : String(error)}`
@@ -1550,6 +1552,9 @@ function sleep(ms) {
   return new Promise(resolve => setTimeout(resolve, ms));
 }
 
+/** GitHub's remaining-quota response header, read from three call sites. */
+const RATELIMIT_REMAINING_HEADER = "x-ratelimit-remaining";
+
 /**
  * How long to wait before retrying a throttled response, bounded.
  *
@@ -1563,7 +1568,7 @@ export function retryDelayMs(response, attempt, maxSeconds) {
   if (Number.isFinite(retryAfter) && retryAfter > 0) {
     return Math.min(retryAfter, maxSeconds) * 1000;
   }
-  const remaining = response.headers?.get?.("x-ratelimit-remaining");
+  const remaining = response.headers?.get?.(RATELIMIT_REMAINING_HEADER);
   const reset = Number(response.headers?.get?.("x-ratelimit-reset"));
   if (remaining === "0" && Number.isFinite(reset)) {
     const seconds = Math.max(0, reset - Math.floor(Date.now() / 1000));
@@ -1613,7 +1618,7 @@ export async function apiGet(api, path, wait = sleep) {
     // 401/403 without rate-limit headers is an auth problem: retrying cannot
     // fix a token that is not allowed to read run history, so fail immediately
     // with a message that names the fix.
-    const remaining = response.headers?.get?.("x-ratelimit-remaining");
+    const remaining = response.headers?.get?.(RATELIMIT_REMAINING_HEADER);
     const throttled =
       response.status === 429 || (response.status === 403 && remaining === "0");
     if ((response.status === 401 || response.status === 403) && !throttled) {
@@ -1782,7 +1787,7 @@ export async function apiWrite(api, method, path, payload, wait = sleep) {
       continue;
     }
     if (response.ok) return await response.json();
-    const remaining = response.headers?.get?.("x-ratelimit-remaining");
+    const remaining = response.headers?.get?.(RATELIMIT_REMAINING_HEADER);
     const throttled =
       response.status === 429 || (response.status === 403 && remaining === "0");
     if ((response.status === 401 || response.status === 403) && !throttled) {

package/typescript/copy-overwrite/scripts/lisa-mutation.mjs

@@ -120,9 +120,7 @@ try {
 
 if (changed.length === 0) {
   console.log(
-    "⚪ Mutation gate: no changed source files vs " +
-      since +
-      ". Nothing to mutate."
+    `⚪ Mutation gate: no changed source files vs ${since}. Nothing to mutate.`
   );
   process.exit(0);
 }