@codyswann/lisa 4.10.8 → 4.10.10

package/plugins/src/base/hooks/block-no-verify.sh

@@ -23,7 +23,7 @@
 # Add a name here in the same commit that closes a vector. A hardening that
 # forgets to is invisible to refresh, and shows up as an unexplained diff at
 # review time instead of a named capability.
-# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, herestring-aware, no-verify-short
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, git-config-parameters-append, herestring-aware, no-verify-short
 #
 # Shell-token matching avoids false positives from issue bodies, heredocs, and
 # commit-message prose while still catching quoted real argv values such as
@@ -449,7 +449,7 @@ for i, token in enumerate(normalized_tokens):
     # `git -c` propagates command-scope config through GIT_CONFIG_PARAMETERS.
     # Parsing the value as Git's shell-quoted parameter list distinguishes the
     # key from an unrelated value that merely contains the same text.
-    if lowered.startswith("git_config_parameters="):
+    if re.match(r"git_config_parameters\+?=", lowered):
         parameters = token.split("=", 1)[1]
         try:
             configured = shlex.split(parameters, posix=True)

package/typescript/copy-contents/.husky/pre-push

@@ -545,8 +545,15 @@ fi
 # without node, whereas jq may legitimately be absent — the audit block above
 # says so in as many words. Deciding this with jq would hand every jq-less
 # machine the slow path without a word.
+# The unit script is selected only when it carries LISA_COVERAGE_SCOPE=unit.
+# That marker is not decoration: the threshold factory reads it and enforces the
+# `unit` block, so a `test:cov:unit` without it is measured against the floor
+# written for the FULL suite while running a strictly smaller population. That
+# is a gate whose thresholds describe a different population than the one it
+# measured, and the honest command for such a project is still `test:cov` —
+# slower, but answering to the floor that was configured for what it runs.
 COVERAGE_SCRIPT="test:cov"
-if node -e 'const s=require("./package.json").scripts||{};process.exit(s["test:cov:unit"]?0:1)' >/dev/null 2>&1; then
+if node -e 'const s=require("./package.json").scripts||{};const u=s["test:cov:unit"];process.exit(typeof u==="string"&&u.includes("LISA_COVERAGE_SCOPE=unit")?0:1)' >/dev/null 2>&1; then
   COVERAGE_SCRIPT="test:cov:unit"
 fi
 

package/typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs

@@ -3541,21 +3541,26 @@ export async function runReport(env, wait) {
     settings.gateContext,
     wait
   );
-  // Measured only where a waiver recipe is actually printed. On a branch this
-  // gate does not guard, the issue already says "you do not need a waiver" and
-  // never names the label — so a missing label there gates nothing, and
-  // reporting it would be a defect against a repository that has none. Skipping
-  // the CALL rather than suppressing the RENDER is deliberate: it makes
-  // "not reported when the gate is unrequired" a property of the wire, which a
-  // renderer edit cannot quietly undo.
+  // Measured only after branch rules prove this gate is required. On a branch
+  // this gate does not guard, the issue already says "you do not need a waiver".
+  // When requiredness itself is unknown, querying the label would turn a label
+  // 404 into a confident defect even though the rules API never proved the
+  // waiver recipe applies. Skipping the CALL rather than suppressing the RENDER
+  // keeps both cases fail-closed at the wire boundary.
   const bypassLabelState =
-    requiredness.state === REQUIREDNESS.notRequired
-      ? Object.freeze({
-          state: BYPASS_LABEL_STATE.notMeasured,
-          detail:
-            "not measured — this gate is not required on this branch, so no waiver recipe is printed and a missing label waives nothing",
-        })
-      : await fetchBypassLabelState(settings.api, settings.bypassLabel, wait);
+    requiredness.state === REQUIREDNESS.required
+      ? await fetchBypassLabelState(settings.api, settings.bypassLabel, wait)
+      : requiredness.state === REQUIREDNESS.notRequired
+        ? Object.freeze({
+            state: BYPASS_LABEL_STATE.notMeasured,
+            detail:
+              "not measured — this gate is not required on this branch, so no waiver recipe is printed and a missing label waives nothing",
+          })
+        : Object.freeze({
+            state: BYPASS_LABEL_STATE.unknown,
+            detail:
+              "not measured — whether this gate is required is unknown, so label state cannot establish whether a waiver recipe applies",
+          });
   const context = {
     branch: settings.branch,
     label: settings.issueLabel,

package/typescript/copy-overwrite/scripts/lisa-mutation.mjs

@@ -1073,12 +1073,30 @@ export const readGate = cwd => {
 
 /**
  * A boolean environment override, or undefined when unset.
+ *
+ * A variable that is SET BUT EMPTY reads as unset, for the same reason
+ * {@link resolveTimeoutShareCeiling} treats an empty share ceiling that way: an
+ * empty value is what GitHub Actions produces when an unset workflow input is
+ * mapped into `env:` — `MUTATION_ENABLED: ${{ inputs.mutation }}` on a caller
+ * that passes nothing sets the variable to "". The declaration is the caller's
+ * and the emptiness is the harness's, so reading the harness's silence as a
+ * deliberate `false` lets an absent input beat a project whose
+ * `mutation.gate.json` says `enabled: true`. The gate stands down, the run goes
+ * green, and nothing anywhere says the gate was asked to.
+ *
+ * Empty was also the only spelling with that asymmetry: every other unrecognised
+ * value — `"yes"`, `"maybe"` — is an operator writing something, and answering
+ * `false` to it is a real reading of a real input. Nobody types the empty string.
+ *
+ * `false` stays reachable, because `false` stays typeable. What changes is that
+ * disabling a gate has to be asked for in a character rather than arrived at
+ * through an absent one.
  * @param {string} name - Variable name.
  * @returns {boolean | undefined} The override.
  */
 export const envFlag = name => {
   const value = process.env[name];
-  if (value === undefined) return undefined;
+  if (value === undefined || value.trim() === "") return undefined;
   return value === "true" || value === "1";
 };
 

package/typescript/package-lisa/package.lisa.json

@@ -9,7 +9,7 @@
       "test:unit": "vitest run --exclude='**/integration/**'",
       "test:integration:lisa": "vitest run '.integration.' 'integration/'",
       "test:cov": "vitest run --coverage",
-      "test:cov:unit": "vitest run --coverage --exclude='**/integration/**'",
+      "test:cov:unit": "LISA_COVERAGE_SCOPE=unit vitest run --coverage --exclude='**/integration/**'",
       "test:mutation": "node scripts/lisa-mutation.mjs",
       "test:watch": "vitest",
       "lint:fix": "oxlint --fix && eslint . --fix",