@codyswann/lisa 3.47.6 → 3.47.8

package/dist/strategies/copy-overwrite.d.ts

@@ -38,10 +38,10 @@ export declare class CopyOverwriteStrategy implements ICopyStrategy {
      * That refresh is unconditional only where Lisa can prove the installed copy
      * is behind. "Differs from mine" is not that proof — it is equally consistent
      * with the host being *ahead*, which is how `acmeorga/frontend` had a guard
-     * they had hardened themselves silently replaced by a weaker upstream one. So
-     * a Lisa-owned artifact is now classified before it is replaced, and anything
-     * short of proof that it is stale leaves the host's copy alone with an
-     * explanation. See `classifyHostCopy`.
+     * they had hardened themselves silently replaced by a weaker upstream one.
+     * That classification now runs in `apply`, before any branch here is chosen,
+     * so it covers the prompted routes too — see `preserveOwnedHostCopy`.
+     * Anything arriving here is either not Lisa's to judge, or provably behind.
      * @param sourcePath - Packaged template path
      * @param destPath - Installed file path
      * @param relativePath - Repo-relative path for reporting
@@ -49,6 +49,25 @@ export declare class CopyOverwriteStrategy implements ICopyStrategy {
      * @returns Whether the file was refreshed, preserved, or left out of date
      */
     private applyNonInteractive;
+    /**
+     * Hold back a replacement of a Lisa-owned artifact on every route that has
+     * one, rather than on the single unattended route.
+     *
+     * Two conditions still let a replacement through. The file must be one Lisa
+     * owns outright — a `tsconfig.json` the project customised is not Lisa's to
+     * judge, and keeps its existing prompt-or-stale behaviour. And the operator
+     * must not have named it to `--refresh-templates`, which is them saying in
+     * advance "take upstream's version of these". That flag is the exit
+     * `describePreserved` tells them to use, so it has to actually work; the
+     * postinstall passes no flags, so honouring it here changes nothing for the
+     * unattended fleet.
+     * @param sourcePath - Packaged template path
+     * @param destPath - Installed file path
+     * @param relativePath - Repo-relative path for reporting
+     * @param context - Strategy context with config and ledger
+     * @returns A preserved result when the copy is kept, else undefined
+     */
+    private preserveOwnedHostCopy;
     /**
      * Hold back a Lisa-owned refresh that cannot be proved to be an upgrade.
      *
@@ -61,6 +80,13 @@ export declare class CopyOverwriteStrategy implements ICopyStrategy {
      * bytes cannot be read they cannot be classified, and a classifier that
      * defaults to "overwrite" when it is confused is the original defect wearing a
      * different hat.
+     *
+     * That sentence described the intent and not the code until now: an
+     * unreadable file returned `undefined`, which is this method's word for
+     * "nothing to preserve", and the caller carried straight on to the overwrite.
+     * `filesIdentical` swallows its own read errors and answers "differs", so an
+     * unreadable Lisa-owned guard reached here on every apply and was replaced
+     * without ever being classified. Now it is kept, and the reason is named.
      * @param sourcePath - Packaged template path
      * @param destPath - Installed file path
      * @param relativePath - Repo-relative path for reporting

package/dist/strategies/copy-overwrite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copy-overwrite.d.ts","sourceRoot":"","sources":["../../src/strategies/copy-overwrite.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAQ7D,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG9E;;;;;;GAMG;AACH,qBAAa,qBAAsB,YAAW,aAAa;IACzD,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;IAE1C;;;;;;;OAOG;IACG,KAAK,CACT,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,mBAAmB,CAAC;IAuD/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,mBAAmB;IAmCjC;;;;;;;;;;;;;;;;;OAiBG;YACW,mBAAmB;CA2BlC"}
+{"version":3,"file":"copy-overwrite.d.ts","sourceRoot":"","sources":["../../src/strategies/copy-overwrite.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAS7D,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG9E;;;;;;GAMG;AACH,qBAAa,qBAAsB,YAAW,aAAa;IACzD,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;IAE1C;;;;;;;OAOG;IACG,KAAK,CACT,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,mBAAmB,CAAC;IA4E/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,mBAAmB;IAwBjC;;;;;;;;;;;;;;;;;OAiBG;YACW,qBAAqB;IAkBnC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,mBAAmB;CAkClC"}

package/dist/strategies/copy-overwrite.js

@@ -2,7 +2,7 @@ import * as fse from "fs-extra";
 import { copyFile, readFile } from "node:fs/promises";
 import { mayRefreshTemplate } from "../core/config.js";
 import { isLisaOwnedTemplate } from "../core/lisa-owned-templates.js";
-import { classifyHostCopy, describePreserved, mayRefreshLisaOwned, } from "../core/lisa-owned-provenance.js";
+import { classifyHostCopy, describePreserved, describeUnclassifiable, mayRefreshLisaOwned, } from "../core/lisa-owned-provenance.js";
 import { filesIdentical, ensureParentDir } from "../utils/file-operations.js";
 /**
  * Copy-overwrite strategy: Replace file if exists (prompts on conflict)
@@ -34,6 +34,22 @@ export class CopyOverwriteStrategy {
         if (await filesIdentical(sourcePath, destPath)) {
             return { relativePath, strategy: this.name, action: "skipped" };
         }
+        // Before any branch below decides *how* to replace the file, ask whether
+        // replacing it is an upgrade at all.
+        //
+        // This classification used to live inside `applyNonInteractive`, which is
+        // reached only when `skipGitCheck` is set — the postinstall's flag, not the
+        // command's. So `lisa apply` typed by an operator, `lisa apply --yes`, and
+        // every non-TTY run took the prompt branch instead and replaced the file
+        // without ever classifying it. Non-TTY is not the exotic case: with no
+        // usable stdin `createPrompter` returns `AutoAcceptPrompter`, whose
+        // `promptOverwrite` answers "yes" without asking anyone, which is what
+        // every scripted and agent-driven apply gets. The guard that stops a guard
+        // being silently downgraded could be walked around by running the command
+        // the normal way (#2577).
+        const preserved = await this.preserveOwnedHostCopy(sourcePath, destPath, relativePath, context);
+        if (preserved !== undefined)
+            return preserved;
         // A non-interactive apply (postinstall / `--skip-git-check`) cannot prompt,
         // and replacing a file the project may have customised without asking is
         // not a decision this path gets to make. So the file is left alone — but
@@ -79,10 +95,10 @@ export class CopyOverwriteStrategy {
      * That refresh is unconditional only where Lisa can prove the installed copy
      * is behind. "Differs from mine" is not that proof — it is equally consistent
      * with the host being *ahead*, which is how `acmeorga/frontend` had a guard
-     * they had hardened themselves silently replaced by a weaker upstream one. So
-     * a Lisa-owned artifact is now classified before it is replaced, and anything
-     * short of proof that it is stale leaves the host's copy alone with an
-     * explanation. See `classifyHostCopy`.
+     * they had hardened themselves silently replaced by a weaker upstream one.
+     * That classification now runs in `apply`, before any branch here is chosen,
+     * so it covers the prompted routes too — see `preserveOwnedHostCopy`.
+     * Anything arriving here is either not Lisa's to judge, or provably behind.
      * @param sourcePath - Packaged template path
      * @param destPath - Installed file path
      * @param relativePath - Repo-relative path for reporting
@@ -91,16 +107,10 @@ export class CopyOverwriteStrategy {
      */
     async applyNonInteractive(sourcePath, destPath, relativePath, context) {
         const { config, backupFile } = context;
-        const lisaOwned = isLisaOwnedTemplate(relativePath);
-        if (!lisaOwned &&
+        if (!isLisaOwnedTemplate(relativePath) &&
             !mayRefreshTemplate(relativePath, config.refreshTemplates)) {
             return { relativePath, strategy: this.name, action: "stale" };
         }
-        if (lisaOwned) {
-            const preserved = await this.preserveIfHostAhead(sourcePath, destPath, relativePath, context.hashLedger);
-            if (preserved !== undefined)
-                return preserved;
-        }
         // Backed up first: opting in to an overwrite is not opting out of being
         // able to undo it.
         if (!config.dryRun) {
@@ -109,6 +119,32 @@ export class CopyOverwriteStrategy {
         }
         return { relativePath, strategy: this.name, action: "overwritten" };
     }
+    /**
+     * Hold back a replacement of a Lisa-owned artifact on every route that has
+     * one, rather than on the single unattended route.
+     *
+     * Two conditions still let a replacement through. The file must be one Lisa
+     * owns outright — a `tsconfig.json` the project customised is not Lisa's to
+     * judge, and keeps its existing prompt-or-stale behaviour. And the operator
+     * must not have named it to `--refresh-templates`, which is them saying in
+     * advance "take upstream's version of these". That flag is the exit
+     * `describePreserved` tells them to use, so it has to actually work; the
+     * postinstall passes no flags, so honouring it here changes nothing for the
+     * unattended fleet.
+     * @param sourcePath - Packaged template path
+     * @param destPath - Installed file path
+     * @param relativePath - Repo-relative path for reporting
+     * @param context - Strategy context with config and ledger
+     * @returns A preserved result when the copy is kept, else undefined
+     */
+    async preserveOwnedHostCopy(sourcePath, destPath, relativePath, context) {
+        if (!isLisaOwnedTemplate(relativePath))
+            return undefined;
+        if (mayRefreshTemplate(relativePath, context.config.refreshTemplates)) {
+            return undefined;
+        }
+        return this.preserveIfHostAhead(sourcePath, destPath, relativePath, context.hashLedger);
+    }
     /**
      * Hold back a Lisa-owned refresh that cannot be proved to be an upgrade.
      *
@@ -121,6 +157,13 @@ export class CopyOverwriteStrategy {
      * bytes cannot be read they cannot be classified, and a classifier that
      * defaults to "overwrite" when it is confused is the original defect wearing a
      * different hat.
+     *
+     * That sentence described the intent and not the code until now: an
+     * unreadable file returned `undefined`, which is this method's word for
+     * "nothing to preserve", and the caller carried straight on to the overwrite.
+     * `filesIdentical` swallows its own read errors and answers "differs", so an
+     * unreadable Lisa-owned guard reached here on every apply and was replaced
+     * without ever being classified. Now it is kept, and the reason is named.
      * @param sourcePath - Packaged template path
      * @param destPath - Installed file path
      * @param relativePath - Repo-relative path for reporting
@@ -132,8 +175,14 @@ export class CopyOverwriteStrategy {
             readFile(destPath).catch(() => undefined),
             readFile(sourcePath).catch(() => undefined),
         ]);
-        if (hostBytes === undefined || lisaBytes === undefined)
-            return undefined;
+        if (hostBytes === undefined || lisaBytes === undefined) {
+            return {
+                relativePath,
+                strategy: this.name,
+                action: "host-ahead",
+                note: describeUnclassifiable(relativePath, hostBytes === undefined),
+            };
+        }
         const verdict = classifyHostCopy(relativePath, hostBytes, lisaBytes, ledger);
         if (mayRefreshLisaOwned(verdict))
             return undefined;

package/dist/strategies/copy-overwrite.js.map

@@ -1 +1 @@
-{"version":3,"file":"copy-overwrite.js","sourceRoot":"","sources":["../../src/strategies/copy-overwrite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,gBAAyB,CAAC;IAE1C;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CACT,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QACxD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAChC,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,MAAM,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,yEAAyE;QACzE,2CAA2C;QAC3C,EAAE;QACF,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,wCAAwC;QACxC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,mBAAmB,CAC7B,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CACR,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,eAAe,CAC3C,YAAY,EACZ,UAAU,EACV,QAAQ,CACT,CAAC;QAEF,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACrC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QACvC,MAAM,SAAS,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;QAEpD,IACE,CAAC,SAAS;YACV,CAAC,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC1D,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC9C,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CAAC,UAAU,CACnB,CAAC;YACF,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;QAChD,CAAC;QAED,wEAAwE;QACxE,mBAAmB;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,MAAmB;QAEnB,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YACzC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAEzE,MAAM,OAAO,GAAG,gBAAgB,CAC9B,YAAY,EACZ,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAC;QACF,IAAI,mBAAmB,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QAEnD,OAAO;YACL,YAAY;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"copy-overwrite.js","sourceRoot":"","sources":["../../src/strategies/copy-overwrite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,gBAAyB,CAAC;IAE1C;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CACT,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QACxD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAChC,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,MAAM,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QAED,yEAAyE;QACzE,qCAAqC;QACrC,EAAE;QACF,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,uEAAuE;QACvE,2EAA2E;QAC3E,0EAA0E;QAC1E,0BAA0B;QAC1B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAChD,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CACR,CAAC;QACF,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAE9C,4EAA4E;QAC5E,yEAAyE;QACzE,yEAAyE;QACzE,2CAA2C;QAC3C,EAAE;QACF,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,wCAAwC;QACxC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,mBAAmB,CAC7B,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CACR,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,eAAe,CAC3C,YAAY,EACZ,UAAU,EACV,QAAQ,CACT,CAAC;QAEF,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACrC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAEvC,IACE,CAAC,mBAAmB,CAAC,YAAY,CAAC;YAClC,CAAC,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC1D,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;QAED,wEAAwE;QACxE,mBAAmB;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,qBAAqB,CACjC,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC;YAAE,OAAO,SAAS,CAAC;QACzD,IAAI,kBAAkB,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAC7B,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CAAC,UAAU,CACnB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,MAAmB;QAEnB,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YACzC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO;gBACL,YAAY;gBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,MAAM,EAAE,YAAY;gBACpB,IAAI,EAAE,sBAAsB,CAAC,YAAY,EAAE,SAAS,KAAK,SAAS,CAAC;aACpE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,CAC9B,YAAY,EACZ,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAC;QACF,IAAI,mBAAmB,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QAEnD,OAAO;YACL,YAAY;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -141,7 +141,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "3.47.6",
+  "version": "3.47.8",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.47.6",
+  "version": "3.47.8",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.47.6",
+  "version": "3.47.8",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/scripts/automation-run-record.mjs

@@ -6,7 +6,13 @@
  * file per loop under `.lisa/automations/runs/`.
  */
 
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import {
+  appendFile,
+  mkdir,
+  readFile,
+  rename,
+  writeFile,
+} from "node:fs/promises";
 import path from "node:path";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -58,7 +64,7 @@ export const DEFAULT_AUTOMATION_RUN_HISTORY_MAX_ENTRIES = 50;
  * same `run_id` and trimming the file to the configured history bound.
  *
  * @param {RecordAutomationRunInput} input
- * @returns {Promise<{ readonly path: string, readonly record: AutomationRunRecord, readonly records: readonly AutomationRunRecord[], readonly appended: boolean, readonly skippedCorruptLines: number, readonly maxEntries: number }>}
+ * @returns {Promise<{ readonly path: string, readonly record: AutomationRunRecord, readonly records: readonly AutomationRunRecord[], readonly appended: boolean, readonly skippedCorruptLines: number, readonly quarantinedLines: number, readonly quarantinePath: string, readonly maxEntries: number }>}
  */
 export async function recordAutomationRun(input) {
   // Write path only. Stored rows are re-validated on read through
@@ -78,6 +84,11 @@ export async function recordAutomationRun(input) {
   const filePath = automationRunRecordPath(projectRoot, record.loop_id);
   const readResult = await readAutomationRunRecords(filePath);
 
+  const quarantinePath = automationRunQuarantinePath(
+    projectRoot,
+    record.loop_id
+  );
+
   if (readResult.records.some(existing => existing.run_id === record.run_id)) {
     return {
       path: filePath,
@@ -85,6 +96,8 @@ export async function recordAutomationRun(input) {
       records: readResult.records,
       appended: false,
       skippedCorruptLines: readResult.skippedCorruptLines,
+      quarantinedLines: 0,
+      quarantinePath,
       maxEntries,
     };
   }
@@ -95,11 +108,38 @@ export async function recordAutomationRun(input) {
   // recognise came back as `[]`, and a row that failed validation came back as
   // nothing at all (#2682, #2578). Only the row being appended is serialised
   // here, so an append can no longer be a fleet-wide migration nobody ran.
-  const nextEntries = [
+  const allEntries = [
     ...readResult.entries,
     { line: JSON.stringify(record), record },
-  ].slice(-maxEntries);
+  ];
+  const nextEntries = allEntries.slice(-maxEntries);
+  // Keeping an unreadable row in place only postponed its deletion. The bound
+  // applies to every stored line, so a row this module could not parse sat in
+  // the window counting down, and somewhere around `maxEntries` appends later
+  // it fell off the front and was gone — with nothing said, and with
+  // `skippedCorruptLines` dropping back to 0 on the next read, so afterwards a
+  // destroyed row looked exactly like one that never existed (#2578).
+  //
+  // A row nobody can parse is the evidence of whatever went wrong, and it is
+  // needed precisely when it is unreadable. Evicting a WELL-FORMED row is the
+  // bounded-history contract working as designed; evicting one nobody could
+  // read is throwing away the only copy. So the second kind is copied to a
+  // sidecar first and the ledger stays bounded.
+  const quarantined = allEntries
+    .slice(0, Math.max(0, allEntries.length - maxEntries))
+    .filter(entry => entry.record === undefined)
+    .map(entry => entry.line);
+
   await mkdir(path.dirname(filePath), { recursive: true });
+  // Sidecar first, ledger second, and a sidecar failure aborts the append
+  // rather than being swallowed. A crash between the two writes leaves the row
+  // in BOTH files, which anyone reading them can reconcile; the other order
+  // leaves it in neither, which nobody can reconstruct. Failing to record one
+  // outcome is recoverable — the runbook contract says a recording failure is
+  // a degradation to report — and destroying the evidence is not.
+  if (quarantined.length > 0) {
+    await quarantineUnreadableLines(quarantinePath, quarantined);
+  }
   await writeJsonlAtomically(
     filePath,
     nextEntries.map(entry => entry.line)
@@ -111,10 +151,74 @@ export async function recordAutomationRun(input) {
     records: nextEntries.flatMap(entry => (entry.record ? [entry.record] : [])),
     appended: true,
     skippedCorruptLines: readResult.skippedCorruptLines,
+    quarantinedLines: quarantined.length,
+    quarantinePath,
     maxEntries,
   };
 }
 
+/**
+ * Where rows this module could not read are kept once the history bound
+ * evicts them from the ledger.
+ *
+ * A sidecar rather than a bigger ledger: the ledger's bound is what keeps a
+ * status read cheap and its history honest, and unreadable rows are not run
+ * history — they are evidence, and evidence has no reason to expire.
+ * @param {string} projectRoot
+ * @param {string} loopId
+ * @returns {string}
+ */
+export function automationRunQuarantinePath(projectRoot, loopId) {
+  return path.join(
+    path.resolve(projectRoot),
+    ".lisa",
+    "automations",
+    "runs",
+    `${normalizeLoopId(loopId)}.quarantine.jsonl`
+  );
+}
+
+/**
+ * Append evicted, unreadable rows verbatim to the quarantine sidecar.
+ *
+ * Appended rather than rewritten, and never parsed or re-serialised: whatever
+ * made a row unreadable is the thing worth keeping, so it is stored as the
+ * exact bytes that were on disk.
+ * @param {string} quarantinePath
+ * @param {readonly string[]} lines
+ * @returns {Promise<void>}
+ */
+async function quarantineUnreadableLines(quarantinePath, lines) {
+  await mkdir(path.dirname(quarantinePath), { recursive: true });
+  await appendFile(quarantinePath, `${lines.join("\n")}\n`, "utf8");
+}
+
+/**
+ * One operator-readable sentence about rows the ledger holds that this module
+ * cannot read, or undefined when there are none.
+ *
+ * `skippedCorruptLines` existed, was returned by both the read and the write
+ * path, and was destructured by every caller — and printed by none of them.
+ * A counter nobody reads is not a control (#2578), so this is the wording the
+ * CLI and the status surface share, and neither has to invent its own.
+ * @param {{ readonly path: string, readonly skippedCorruptLines: number, readonly quarantinedLines: number, readonly quarantinePath: string }} input
+ * @returns {string | undefined}
+ */
+export function describeUnreadableLedgerRows(input) {
+  const sentences = [];
+  if (input.quarantinedLines > 0) {
+    sentences.push(
+      `${input.path}: ${input.quarantinedLines} row(s) this run could not read reached the end of the bounded history. They were copied to ${input.quarantinePath} before the ledger was trimmed, so nothing was deleted.`
+    );
+  }
+  if (input.skippedCorruptLines > 0) {
+    sentences.push(
+      `${input.path}: ${input.skippedCorruptLines} stored row(s) are not readable as run records. They are kept exactly as written and are excluded from run history, and each will be copied to ${input.quarantinePath} before the history bound evicts it. Open the file, fix or remove those lines, and the message stops.`
+    );
+  }
+  return sentences.length > 0 ? sentences.join(" ") : undefined;
+}
+
 /**
  * @param {string} projectRoot
  * @returns {Promise<number>}
@@ -501,8 +605,24 @@ export async function runAutomationRunRecordCli(argv) {
         outcome: result.record.outcome,
         loop_id: result.record.loop_id,
         run_id: result.record.run_id,
+        skipped_corrupt_lines: result.skippedCorruptLines,
+        quarantined_lines: result.quarantinedLines,
       })}\n`
     );
+    // Printed, not merely returned. Every registered loop runs this CLI on
+    // every cycle, and its stderr is read by whoever ran it — so this is the
+    // most frequently consulted surface the condition has, and it is the one
+    // that used to say nothing at all (#2578).
+    const notice = describeUnreadableLedgerRows(result);
+    if (notice !== undefined) {
+      process.stderr.write(`${notice}\n`);
+    }
+    // Still 0. The append SUCCEEDED, and reporting a successful write as a
+    // failure is the same defect pointed the other way — the loop would record
+    // a degradation that did not happen, on every cycle, until someone edited
+    // the file. The refusal that matters is already above: an append that
+    // cannot save an evicted row throws before the ledger is rewritten, and
+    // lands here as exit 1 with the reason.
     return 0;
   } catch (error) {
     process.stderr.write(`${error.message}\n`);

package/plugins/lisa/scripts/automation-status-claude-adapter.mjs

@@ -18,6 +18,7 @@ import {
 import {
   RUNBOOK_NOT_SCAFFOLDED_LINE,
   resolveAutomationRunDisplay,
+  resolveLedgerIntegrityFinding,
   resolveRecoveryEscalation,
 } from "./automation-status-run-history.mjs";
 import { resolveUnrecordedRunFinding } from "./automation-status-unrecorded-runs.mjs";
@@ -266,13 +267,20 @@ function createObservedStatusItem(input) {
       ? resolveObservedCadenceMs({ observed, expected })
       : null,
   });
+  // Ranked last of the three. A scheduler entry that is off, or a run the
+  // ledger never received, describes the loop; unreadable rows describe the
+  // ledger. Reporting the storage problem over either cause would bury the
+  // cause — but with nothing else to say, it is said rather than counted where
+  // nobody looks (#2578).
+  const ledgerIntegrity = resolveLedgerIntegrityFinding(runDisplay);
   const runSignal =
     primaryRunSignal ??
     (unrecorded && {
       status: /** @type {const} */ ("DRIFTED"),
       summary: unrecorded.summary,
       remediation: unrecorded.remediation,
-    });
+    }) ??
+    ledgerIntegrity;
 
   const observedDetails = [comparison.observed];
   if (observed?.status) {

package/plugins/lisa/scripts/automation-status-codex-adapter.mjs

@@ -27,6 +27,7 @@ import {
 import {
   RUNBOOK_NOT_SCAFFOLDED_LINE,
   resolveAutomationRunDisplay,
+  resolveLedgerIntegrityFinding,
   resolveRecoveryEscalation,
 } from "./automation-status-run-history.mjs";
 import { resolveUnrecordedRunFinding } from "./automation-status-unrecorded-runs.mjs";
@@ -689,13 +690,20 @@ function createObservedStatusItem(input) {
       ? resolveObservedCadenceMs({ observed, expected })
       : null,
   });
+  // Ranked last of the three. A suspended scheduler entry, or a run the ledger
+  // never received, describes the loop; unreadable rows describe the ledger.
+  // Reporting the storage problem over either cause would bury the cause — but
+  // with nothing else to say, it is said rather than counted where nobody
+  // looks (#2578).
+  const ledgerIntegrity = resolveLedgerIntegrityFinding(runDisplay);
   const runSignal =
     primaryRunSignal ??
     (unrecorded && {
       status: /** @type {const} */ ("DRIFTED"),
       summary: unrecorded.summary,
       remediation: unrecorded.remediation,
-    });
+    }) ??
+    ledgerIntegrity;
 
   const observedDetails = [comparison.observed];
   if (observed?.status) {

package/plugins/lisa/scripts/automation-status-run-history.mjs

@@ -19,6 +19,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 
 import {
+  automationRunQuarantinePath,
   automationRunRecordPath,
   readAutomationRunRecords,
 } from "./automation-run-record.mjs";
@@ -59,6 +60,8 @@ const NO_RECORDED_RUNS_LINE = "no recorded runs yet";
  *   readonly recoveryRequiredStreak: number
  *   readonly recoverySummaries: readonly string[]
  *   readonly skippedCorruptLines: number
+ *   readonly recordsPath: string
+ *   readonly quarantinePath: string
  * }} AutomationRunDisplay
  */
 
@@ -75,9 +78,9 @@ const NO_RECORDED_RUNS_LINE = "no recorded runs yet";
 export async function resolveAutomationRunDisplay(input) {
   const projectRoot = path.resolve(input.projectRoot ?? process.cwd());
   const runbook = await resolveRunbookLine(projectRoot, input.runbookPath);
-  const { records, skippedCorruptLines } = await readAutomationRunRecords(
-    automationRunRecordPath(projectRoot, input.loopId)
-  );
+  const recordsPath = automationRunRecordPath(projectRoot, input.loopId);
+  const { records, skippedCorruptLines } =
+    await readAutomationRunRecords(recordsPath);
 
   const newestFirst = records.toReversed();
   const latest = records.at(-1);
@@ -101,6 +104,34 @@ export async function resolveAutomationRunDisplay(input) {
     recoveryRequiredStreak: trailingRecovery.length,
     recoverySummaries: trailingRecovery.map(record => record.summary),
     skippedCorruptLines,
+    recordsPath,
+    quarantinePath: automationRunQuarantinePath(projectRoot, input.loopId),
+  };
+}
+
+/**
+ * Report a ledger holding rows this module cannot read as drift.
+ *
+ * `skippedCorruptLines` was computed on every read, returned by both the read
+ * and the write path, and destructured by every caller — and printed by none
+ * of them. A counter nobody reads is not a control, and this one guarded the
+ * only evidence that a loop's own history had been damaged (#2578).
+ *
+ * `DRIFTED`, not `FAILING`: the ledger is local scheduler state, and rows it
+ * cannot read say nothing about whether the loop is doing its job. Escalating
+ * it to a loop failure would misattribute a storage problem to the automation
+ * and bury the real health signal underneath it.
+ * @param {AutomationRunDisplay | undefined} runDisplay
+ * @returns {{ readonly status: "DRIFTED", readonly summary: string, readonly remediation: string } | null}
+ */
+export function resolveLedgerIntegrityFinding(runDisplay) {
+  if (!runDisplay || runDisplay.skippedCorruptLines < 1) {
+    return null;
+  }
+  return {
+    status: "DRIFTED",
+    summary: `${runDisplay.skippedCorruptLines} stored run record(s) in this loop's history cannot be read`,
+    remediation: `Open ${runDisplay.recordsPath} and look at the lines that are not valid run records. They are left exactly as written and are left out of the history above, so the outcomes shown are an incomplete picture. Nothing deletes them: each is copied to ${runDisplay.quarantinePath} before the history bound would evict it. Fix or remove those lines and this stops being reported.`,
   };
 }
 

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.47.6",
+  "version": "3.47.8",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"