@codyswann/lisa 4.22.11 → 4.22.13

package/plugins/src/base/skills/lisa-jira-journey/scripts/parse-plan.py

@@ -33,6 +33,7 @@ import sys
 import urllib.request
 from base64 import b64encode
 from pathlib import Path
+from urllib.parse import urlsplit
 
 
 # Intentionally matches the exact local-claim prefixes only. EVIDENCE-REF is a
@@ -66,13 +67,50 @@ def jira_config_candidates():
     return candidates
 
 
+def read_jira_config(config_path):
+    """Read the server and login fields from one jira-cli config."""
+    server = ""
+    login = ""
+    with open(config_path) as config:
+        for line in config:
+            if line.startswith("server:"):
+                server = line.split(":", 1)[1].strip()
+            elif line.startswith("login:"):
+                login = line.split(":", 1)[1].strip()
+    return server, login
+
+
+def server_origin(server):
+    """Return the normalized HTTPS origin used as the credential trust key."""
+    try:
+        parsed = urlsplit(server)
+        port = parsed.port
+    except ValueError:
+        return ""
+    if parsed.scheme.lower() != "https" or not parsed.hostname:
+        return ""
+    authority = parsed.hostname.lower()
+    if port and port != 443:
+        authority = f"{authority}:{port}"
+    return f"https://{authority}"
+
+
 def resolve_jira_config_path():
-    """Resolve the first existing project config, then the home fallback."""
+    """Resolve a project config only when its host matches a user trust root."""
     candidates = jira_config_candidates()
-    for candidate in candidates:
-        if candidate.exists():
+    home_config = candidates[-1]
+    trusted_server = os.environ.get("JIRA_SERVER", "").strip()
+    if not trusted_server and home_config.exists():
+        trusted_server, _ = read_jira_config(home_config)
+    trusted_origin = server_origin(trusted_server)
+
+    for candidate in candidates[:-1]:
+        if not candidate.exists():
+            continue
+        candidate_server, _ = read_jira_config(candidate)
+        if trusted_origin and server_origin(candidate_server) == trusted_origin:
             return candidate
-    return candidates[-1]
+    return home_config
 
 
 def get_jira_config():
@@ -82,14 +120,18 @@ def get_jira_config():
         print(f"ERROR: jira-cli config not found at {config_path}", file=sys.stderr)
         sys.exit(1)
 
-    server = ""
-    login = ""
-    with open(config_path) as f:
-        for line in f:
-            if line.startswith("server:"):
-                server = line.split(":", 1)[1].strip()
-            elif line.startswith("login:"):
-                login = line.split(":", 1)[1].strip()
+    server, login = read_jira_config(config_path)
+
+    trusted_server = os.environ.get("JIRA_SERVER", "").strip()
+    trusted_origin = server_origin(trusted_server)
+    if trusted_origin:
+        if server_origin(server) != trusted_origin:
+            print("ERROR: jira-cli config server does not match trusted JIRA_SERVER", file=sys.stderr)
+            sys.exit(1)
+        server = trusted_server.rstrip("/")
+    if not server_origin(server):
+        print("ERROR: JIRA server must be an HTTPS URL from a trusted config", file=sys.stderr)
+        sys.exit(1)
 
     token = os.environ.get("JIRA_API_TOKEN", "")
     if not token:

package/plugins/src/base/skills/lisa-linear-build-intake/SKILL.md

@@ -21,20 +21,19 @@ This skill is the destination of the `lisa-tracker-build-intake` shim when `trac
 Build-queue **workflow state** names are read from `.lisa.config.json` `linear.workflow.*`, falling back to defaults documented in the `config-resolution` rule. Bash pattern:
 
 ```bash
-# Read role with default fallback. Local overrides global per-key.
 read_role() {
   # Single resolver — see config-resolution "The single resolver".
   # Exit 0 + empty output means an OPTIONAL role is unset: skip that transition,
-  # never substitute the second argument. A default on an optional role is what
-  # made "unset" indistinguishable from "not customized".
-  node "${CLAUDE_PLUGIN_ROOT}/scripts/resolve-lifecycle-role.mjs" \
-    --role "$1" --vendor linear --intent "${3:-read}" 2>/dev/null
+  # never substitute a default. Any non-zero status is a resolver failure and
+  # remains visible to the caller.
+  node "${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/resolve-lifecycle-role.mjs" \
+    --role "$1" --vendor linear --intent "${2:-read}"
 }
 
-READY=$(read_role ready "Ready")
-CLAIMED=$(read_role claimed "In Progress")
-REVIEW=$(read_role review "In Review")
-BLOCKED=$(read_role blocked "Blocked")
+READY=$(read_role ready read) || exit $?
+CLAIMED=$(read_role claimed write) || exit $?
+REVIEW=$(read_role review write) || exit $?
+BLOCKED=$(read_role blocked read) || exit $?
 ```
 
 For env-keyed `done`, resolve the env first, then look up `done[<env>]`:
@@ -69,7 +68,7 @@ else
 fi
 ```
 
-In prose below, the role names refer to the resolved **states**: e.g. "the `ready` state" means whatever `linear.workflow.ready` resolves to (default: `Ready`).
+In prose below, the role names refer to the configured **states**: e.g. "the `ready` state" means whatever `linear.workflow.ready` resolves to. Required roles must be configured; optional roles carry no default.
 
 ## Why native states, not labels
 

package/plugins/src/base/skills/lisa-linear-evidence/SKILL.md

@@ -109,6 +109,6 @@ Return:
 ## Rules
 
 - Never modify the Issue description as part of evidence posting — comments only. Description edits go through `lisa-linear-write-issue`.
-- Never skip the label transition. The build queue is keyed off the configured `linear.workflow.*` labels; an item that ships without transitioning is invisible to monitoring.
+- Never skip the transition when `review` is configured. An empty `$REVIEW` is the one sanctioned skip (Phase 5): post the evidence comment, leave the Issue in `$CLAIMED`, and report the skip. Whenever `$REVIEW` is non-empty, the configured native state transition is mandatory.
 - If `lisa-linear-access operation: save-comment` fails, retry once. If it fails again, surface the error — don't pretend the comment was posted.
 - Do not delete prior comments. The history is the audit trail.

package/plugins/src/base/skills/lisa-linear-sync/SKILL.md

@@ -152,7 +152,7 @@ When the caller passes `--rollup`, this skill **derives a parent/container's wor
 
 ## Rules
 
-- Never transition a leaf Issue's workflow `state` from this skill at all. `--rollup` (parent derivation, per the `leaf-only-lifecycle` rule) is the only write path that remains; every other milestone SUGGESTS a transition in its comment and nothing more. The state is the lifecycle lane, so a write here would move the item in the build queue.
+- Never transition a leaf Issue's workflow `state` from this skill except for the narrowly defined Phase 4b backstop that reopens a leaf auto-closed at an intermediate environment. `--rollup` remains the only other write path (parent derivation, per the `leaf-only-lifecycle` rule); every normal milestone SUGGESTS a transition in its comment and nothing more. The state is the lifecycle lane, so an unscoped write here would move the item in the build queue.
 - Never resolve a role by searching the team's states. Only a name the project configured may be written; a `type`- or position-derived match may inform a read and must never supply a write target (`config-resolution`, R2).
 - Rollup derives a *parent's* workflow state from its children and never rolls a parent into the human-owned ready lane (never `$READY`). It cites the `leaf-only-lifecycle` rule by slug rather than restating the state machine.
 - Never post empty or minimal comments — if a milestone has no meaningful content, skip the post.

package/plugins/src/base/skills/lisa-repair-intake/SKILL.md

@@ -728,7 +728,8 @@ node "${CLAUDE_PLUGIN_ROOT}/scripts/rollup-blocker-classification.mjs" \
    report already asks a person to decide.
 
 3. **If the derived state differs from the parent's current state, apply it** via the vendor's
-   lifecycle write (JIRA transition, GitHub/Linear label swap keeping exactly one `status:*`),
+   lifecycle write: a JIRA transition; a GitHub label swap keeping exactly one `status:*`; or a
+   Linear `save-issue` update that writes the resolved workflow `stateId`, never a lifecycle label.
    removing any conflicting stale build lifecycle role — **including a stale `ready`** the parent
    should never carry. Post an idempotent `[lisa-repair-intake]` rollup note naming the derived
    state and the child tally (honor the backoff window + fingerprint). Include that exact rendered

package/plugins/src/base/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -131,6 +131,7 @@ export function probe(name, exec = boundedChildOutput) {
     return { present: true, version: extractVersion(out) };
   } catch (err) {
     if (err.code === "ENOENT") return { present: false, version: null };
+    if (err.code === "ETIMEDOUT") throw err;
     const output = `${err.stdout ?? ""}${err.stderr ?? ""}`;
     return { present: true, version: extractVersion(output) };
   }
@@ -808,9 +809,9 @@ export function installUserSessionHook(repoRoot, options = {}) {
   const dir = join(home, ".claude");
   const settingsPath = join(dir, "settings.json");
   // Settings stores shell source, so the absolute path still needs quoting.
-  // JSON string syntax is accepted by the shell for ordinary path text and
-  // safely escapes spaces, quotes, dollars and backticks.
-  const command = `bash ${JSON.stringify(script)}`;
+  // Single quotes suppress parameter expansion and command substitution. An
+  // embedded quote closes, escapes, and reopens the quoted shell word.
+  const command = `bash '${script.replaceAll("'", `'\\''`)}'`;
 
   let settings = {};
   if (exists(settingsPath)) {

package/plugins/src/base/skills/lisa-tracker-sync/SKILL.md

@@ -37,11 +37,11 @@ Two consequences the vendor arms must not restate differently:
 Resolve roles through the shared resolver rather than an inlined helper:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/scripts/resolve-lifecycle-role.mjs" \
+node "${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/resolve-lifecycle-role.mjs" \
   --role <role> --vendor <jira|linear|github> --intent <read|write> [--env <env>]
 ```
 
-Exit `0` with a value means configured; exit `0` with **empty** output means an optional role is unset — skip the transition; exit `2` means a required role is unset or a write was refused a fallback value.
+Exit `0` with a value means configured; exit `0` with **empty** output means an optional role is unset — skip the transition; exit `2` means a required role is unset or a write was refused a fallback value. Any other exit is a resolver failure, never an unset role.
 
 If `$ARGUMENTS` is empty, all vendor skills auto-detect a ticket reference from the active plan file (most recently modified `.md` in `plans/`).
 

package/rails/copy-overwrite/scripts/threshold-ratchet-families.mjs

@@ -82,7 +82,7 @@ export const FAMILIES = [
   },
   {
     id: "lighthouse",
-    match: /(^|\/)lighthouserc-config\.json$/,
+    match: /(^|\/)(?:lighthouserc-config|lighthouserc|\.lighthouserc)\.json$/,
     kind: "lighthouse",
   },
 ];
@@ -101,6 +101,8 @@ export const LIGHTHOUSE_ASSERTION_DIRECTIONS = Object.freeze({
   maxLength: "max",
 });
 
+const LIGHTHOUSE_LEVELS = Object.freeze({ off: 0, warn: 1, error: 2 });
+
 /**
  * Extract numeric Lighthouse assertions with a direction chosen per key.
  *
@@ -136,6 +138,13 @@ export function extractLighthouseAssertions(conf) {
     return out;
   }
   for (const [audit, spec] of Object.entries(assertions)) {
+    const level = Array.isArray(spec) ? spec[0] : spec;
+    if (typeof level === "string" && Object.hasOwn(LIGHTHOUSE_LEVELS, level)) {
+      out.set(`${audit}.$level`, {
+        value: LIGHTHOUSE_LEVELS[level],
+        direction: "min",
+      });
+    }
     const options =
       Array.isArray(spec) &&
       spec.length >= 2 &&

package/typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs

@@ -2002,7 +2002,7 @@ function bypassParagraph(claim, context) {
 function bypassLabelLines(context) {
   const label = context.bypassLabel;
   const measured = context.bypassLabelState;
-  const state = measured?.state ?? BYPASS_LABEL_STATE.unknown;
+  const state = measured?.state ?? BYPASS_LABEL_STATE.notMeasured;
   if (state === BYPASS_LABEL_STATE.absent) {
     return [
       "> [!CAUTION]",
@@ -3377,7 +3377,8 @@ export function resolveSettings(env) {
     freshnessHours: limits.freshnessHours,
     bootstrapUntil: env.NIGHTLY_BOOTSTRAP_UNTIL || "",
     bootstrapMaxDays: limits.bootstrapMaxDays,
-    bypassLabel: env.NIGHTLY_BYPASS_LABEL || DEFAULT_BYPASS_LABEL,
+    bypassLabel:
+      String(env.NIGHTLY_BYPASS_LABEL ?? "").trim() || DEFAULT_BYPASS_LABEL,
     bypassMaxHours: limits.bypassMaxHours,
     // An ADDITIONAL project rule, never a replacement — see `evaluateBypass`.
     extraBypassReasonPattern: env.NIGHTLY_BYPASS_REASON_PATTERN || "",
@@ -3550,17 +3551,13 @@ export async function runReport(env, wait) {
   const bypassLabelState =
     requiredness.state === REQUIREDNESS.required
       ? await fetchBypassLabelState(settings.api, settings.bypassLabel, wait)
-      : requiredness.state === REQUIREDNESS.notRequired
-        ? Object.freeze({
-            state: BYPASS_LABEL_STATE.notMeasured,
-            detail:
-              "not measured — this gate is not required on this branch, so no waiver recipe is printed and a missing label waives nothing",
-          })
-        : Object.freeze({
-            state: BYPASS_LABEL_STATE.unknown,
-            detail:
-              "not measured — whether this gate is required is unknown, so label state cannot establish whether a waiver recipe applies",
-          });
+      : Object.freeze({
+          state: BYPASS_LABEL_STATE.notMeasured,
+          detail:
+            requiredness.state === REQUIREDNESS.notRequired
+              ? "not measured — this gate is not required on this branch, so no waiver recipe is printed and a missing label waives nothing"
+              : "not measured — whether this gate is required could not be read, so the labels API was not queried",
+        });
   const context = {
     branch: settings.branch,
     label: settings.issueLabel,

package/typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs

@@ -188,7 +188,8 @@
  *     content problem and never says the word "permission".
  *
  * A refusal is not a finding: it fails, and under `"enforcement": "warn"` it is
- * loud and exits 0, matching what an untranscribed snapshot already does.
+ * normally loud and exits 0. `--require-review-evidence` is the deliberate
+ * exception: a refusal then blocks because the caller required proven evidence.
  *
  * ## `--fail-on-vacuous` — the supported exit code
  *
@@ -1541,18 +1542,48 @@ export function fetchChecksForCommit(sha, repo) {
   );
   const runs = ghApiPaginatedArray(
     `repos/${slug}/commits/${sha}/check-runs?per_page=100`,
-    '[.check_runs[] | {name: .name, conclusion: .conclusion, description: (.output.title // "")}]'
+    '[.check_runs[] | {id: .id, name: .name, conclusion: .conclusion, description: (.output.title // ""), completed_at: .completed_at, started_at: .started_at}]'
   );
   return mergeCheckRows(
     statuses.map(row =>
       normalizeCheckRow(row.name, row.state, row.description)
     ),
-    runs.map(row =>
+    newestCheckRuns(runs).map(row =>
       normalizeCheckRow(row.name, row.conclusion, row.description)
     )
   );
 }
 
+/**
+ * Keep the newest check run for each name across every check suite on a SHA.
+ * @param {ReadonlyArray<object>} runs Raw check-run rows with timestamps and ids.
+ * @returns {object[]} One newest row per name.
+ */
+export function newestCheckRuns(runs) {
+  const newest = new Map();
+  const rank = row => {
+    const timestamp = Date.parse(row.completed_at ?? row.started_at ?? "");
+    return [Number.isFinite(timestamp) ? timestamp : 0, Number(row.id) || 0];
+  };
+  for (const row of runs) {
+    const name = String(row?.name ?? "");
+    const previous = newest.get(name);
+    if (!previous) {
+      newest.set(name, row);
+      continue;
+    }
+    const [rowTime, rowId] = rank(row);
+    const [previousTime, previousId] = rank(previous);
+    if (
+      rowTime > previousTime ||
+      (rowTime === previousTime && rowId > previousId)
+    ) {
+      newest.set(name, row);
+    }
+  }
+  return [...newest.values()];
+}
+
 /**
  * Collapse GitHub's two reporter APIs into one authoritative row per name.
  *

package/typescript/copy-overwrite/scripts/lisa-mutation.mjs

@@ -184,6 +184,7 @@ export const OUTCOMES = Object.freeze({
   dryRunTimeout: "mutation-gate: dry-run-timeout",
   scoreBelowBreak: "mutation-gate: score-below-break",
   runFailed: "mutation-gate: run-failed",
+  invalidMutatePattern: "mutation-gate: invalid-mutate-pattern",
   childDeadline: "mutation-gate: child-deadline",
   sandboxReclaimed: "mutation-gate: sandbox-reclaimed",
   timeoutAccounting: "mutation-gate: timeout-accounting",
@@ -297,6 +298,11 @@ export const globToRegExp = glob => {
     } else if (char === "," && braceDepth > 0) source += "|";
     else source += char.replaceAll(/[.+^${}()|[\]\\]/gu, "\\$&");
   }
+  if (braceDepth !== 0) {
+    throw new Error(
+      `mutate pattern "${glob}" has ${braceDepth} unclosed "{" — fix the brace alternation in your Stryker config.`
+    );
+  }
   return new RegExp(`${source}$`, "u");
 };
 
@@ -2013,7 +2019,17 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
   }
 
   const declaration = resolveMutateDeclaration(cwd);
-  const patterns = compileMutatePatterns(declaration.mutate);
+  let patterns;
+  try {
+    patterns = compileMutatePatterns(declaration.mutate);
+  } catch (error) {
+    console.error(
+      `❌ ${OUTCOMES.invalidMutatePattern}\n` +
+        `   ${error instanceof Error ? error.message : String(error)}\n` +
+        `   Fix the \`mutate\` patterns in ${declaration.source} before re-running.`
+    );
+    return 1;
+  }
 
   if (countMutateTargetsInRepo(cwd, patterns) === 0) {
     console.error(

package/typescript/copy-overwrite/scripts/threshold-ratchet-families.mjs

@@ -82,7 +82,7 @@ export const FAMILIES = [
   },
   {
     id: "lighthouse",
-    match: /(^|\/)lighthouserc-config\.json$/,
+    match: /(^|\/)(?:lighthouserc-config|lighthouserc|\.lighthouserc)\.json$/,
     kind: "lighthouse",
   },
 ];
@@ -101,6 +101,8 @@ export const LIGHTHOUSE_ASSERTION_DIRECTIONS = Object.freeze({
   maxLength: "max",
 });
 
+const LIGHTHOUSE_LEVELS = Object.freeze({ off: 0, warn: 1, error: 2 });
+
 /**
  * Extract numeric Lighthouse assertions with a direction chosen per key.
  *
@@ -136,6 +138,13 @@ export function extractLighthouseAssertions(conf) {
     return out;
   }
   for (const [audit, spec] of Object.entries(assertions)) {
+    const level = Array.isArray(spec) ? spec[0] : spec;
+    if (typeof level === "string" && Object.hasOwn(LIGHTHOUSE_LEVELS, level)) {
+      out.set(`${audit}.$level`, {
+        value: LIGHTHOUSE_LEVELS[level],
+        direction: "min",
+      });
+    }
     const options =
       Array.isArray(spec) &&
       spec.length >= 2 &&