@codyswann/lisa 4.22.9 → 4.22.10

package/all/copy-overwrite/scripts/lib/process-tree-runner.mjs

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/**
+ * Run one shell command in its own process group and reap the whole group.
+ *
+ * Node's synchronous timeout signals only the direct child. A gate command is
+ * a tree (shell, package manager, test workers), so killing only the shell
+ * leaves descendants running against scratch state the caller then removes.
+ * This small asynchronous supervisor is invoked through a synchronous parent:
+ * it owns the process-group id, applies the deadline, terminates the group, and
+ * only then lets the parent continue.
+ * @module scripts/lib/process-tree-runner
+ */
+
+import { spawn, spawnSync } from "node:child_process";
+
+import { invokedAsScript } from "./invoked-as-script.mjs";
+
+const KILL_GRACE_MS = 750;
+
+function parseArguments(argv) {
+  const timeoutArg = argv.find(value => value.startsWith("--timeout-ms="));
+  const separator = argv.indexOf("--");
+  const timeoutMs = Number(timeoutArg?.slice("--timeout-ms=".length));
+  const command = separator >= 0 ? argv.slice(separator + 1).join(" ") : "";
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || !command) {
+    throw new Error(
+      "usage: process-tree-runner.mjs --timeout-ms=<positive-ms> -- <command>"
+    );
+  }
+  return { command, timeoutMs };
+}
+
+function killTree(pid, signal) {
+  if (process.platform === "win32") {
+    // Windows has no negative-pid process groups. taskkill /T is the native
+    // tree primitive; /F is used only for the escalation.
+    const args = ["/pid", String(pid), "/T"];
+    if (signal === "SIGKILL") args.push("/F");
+    spawnSync("taskkill", args, { stdio: "ignore", timeout: KILL_GRACE_MS });
+    return;
+  }
+  try {
+    process.kill(-pid, signal);
+  } catch {
+    // ESRCH means the whole group already exited.
+  }
+}
+
+export function supervise(command, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const shell =
+      process.platform === "win32"
+        ? process.env.ComSpec || "cmd.exe"
+        : "/bin/sh";
+    const shellArgs =
+      process.platform === "win32"
+        ? ["/d", "/s", "/c", command]
+        : ["-c", command];
+    const child = spawn(shell, shellArgs, {
+      detached: true,
+      env: process.env,
+      stdio: "inherit",
+    });
+    const pid = child.pid;
+    if (pid === undefined) {
+      reject(new Error("gate process tree did not start"));
+      return;
+    }
+
+    let timedOut = false;
+    let settled = false;
+    const finish = (code, signal) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(deadline);
+      // A command may leave a background descendant after its direct shell
+      // exits. Reap that residue before returning a verdict too.
+      killTree(pid, "SIGTERM");
+      resolve({ code, signal });
+    };
+
+    const deadline = setTimeout(() => {
+      timedOut = true;
+      killTree(pid, "SIGTERM");
+      setTimeout(() => {
+        killTree(pid, "SIGKILL");
+        // A signal-shaped result is the existing gate runner vocabulary for
+        // "no verdict". It also prevents an ordinary exit code such as 124
+        // from being confused with a user command that returned that code.
+        if (process.platform === "win32") {
+          process.exit(124);
+        } else {
+          process.kill(process.pid, "SIGKILL");
+        }
+      }, KILL_GRACE_MS);
+    }, timeoutMs);
+
+    child.once("error", error => {
+      clearTimeout(deadline);
+      killTree(pid, "SIGKILL");
+      reject(error);
+    });
+    child.once("close", (code, signal) => {
+      // On timeout, wait for the forced group reap above before this supervisor
+      // ends. Exiting on the direct shell's close is the race that used to leave
+      // its descendants alive.
+      if (!timedOut) finish(code, signal);
+    });
+  });
+}
+
+async function main() {
+  const { command, timeoutMs } = parseArguments(process.argv.slice(2));
+  const result = await supervise(command, timeoutMs);
+  if (result.signal) {
+    process.exitCode = 128;
+  } else {
+    process.exitCode = result.code ?? 1;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
+  await main();
+}

package/all/copy-overwrite/scripts/lisa-floor-collisions.mjs

@@ -85,11 +85,45 @@ const DEPENDENCY_SECTIONS = [
  * means: `^8` is `>=8.0.0 <9.0.0` and `1.x` is `>=1.0.0 <2.0.0`. Only the lower
  * bound is read here, so the upper half costs nothing to ignore.
  *
- * Still one left-to-right pass: the optional groups each have a literal `.`
- * ahead of them, so there is no position at which the engine has two viable
- * ways to match and nothing to backtrack over (S5852).
+ * This parser deliberately uses no version-shaped regular expression. The
+ * collision gate consumes dependency text supplied by a repository, so even a
+ * bounded-looking optional-group expression becomes an avoidable ReDoS review
+ * burden. A tiny left-to-right scanner is both clearer and constant-work per
+ * input character.
  */
-const BRANCH_VERSION = /^[\sv=><~^]*(\d+)(?:\.(\d+))?(?:\.(\d+))?/;
+function parseBranchVersion(branch) {
+  let cursor = branch.trimStart();
+  while (cursor.startsWith("v")) cursor = cursor.slice(1);
+
+  const operator = [">=", ">", "=", "^", "~"].find(candidate =>
+    cursor.startsWith(candidate)
+  );
+  if (operator) cursor = cursor.slice(operator.length);
+  cursor = cursor.trimStart();
+
+  let end = 0;
+  while (end < cursor.length) {
+    const character = cursor[end];
+    const digit = character >= "0" && character <= "9";
+    const next = cursor[end + 1];
+    const componentSeparator = character === "." && next >= "0" && next <= "9";
+    if (!digit && !componentSeparator) break;
+    end += 1;
+  }
+
+  const parts = cursor.slice(0, end).split(".");
+  if (
+    parts.length > 3 ||
+    parts.some(
+      part =>
+        part === "" ||
+        [...part].some(character => character < "0" || character > "9")
+    )
+  ) {
+    return null;
+  }
+  return { operator, parts };
+}
 
 /**
  * Lowest version a single disjunction branch permits.
@@ -104,13 +138,34 @@ const BRANCH_VERSION = /^[\sv=><~^]*(\d+)(?:\.(\d+))?(?:\.(\d+))?/;
 function branchLowerBound(branch) {
   const trimmed = branch.trim();
   if (trimmed === "") return null;
-  if (/^<=?\s*\d/.test(trimmed)) return [0, 0, 0];
-  const match = BRANCH_VERSION.exec(trimmed);
-  if (!match) return null;
+  const upperOperand = trimmed
+    .slice(trimmed.startsWith("<=") ? 2 : 1)
+    .trimStart();
+  if (
+    trimmed.startsWith("<") &&
+    upperOperand[0] >= "0" &&
+    upperOperand[0] <= "9"
+  ) {
+    return [0, 0, 0];
+  }
+  const parsed = parseBranchVersion(trimmed);
+  if (!parsed) return null;
   // An absent minor or patch is zero, not missing: `^8` is `>=8.0.0`. Number()
   // of undefined is NaN, which would compare as neither higher nor lower than
   // anything and quietly disable the comparison it feeds.
-  return [match[1], match[2] ?? "0", match[3] ?? "0"].map(Number);
+  const lower = [...parsed.parts, "0", "0"].slice(0, 3).map(Number);
+  if (parsed.operator !== ">") return lower;
+
+  // npm expands a STRICT comparator on a partial version before comparing:
+  // `>1` is `>=2.0.0` and `>1.2` is `>=1.3.0`. Reading either as merely
+  // 1.0.0/1.2.0 invents versions the range does not permit and can report an
+  // adequate dependency line as weaker than its override.
+  const lastSpecified = parsed.parts.length - 1;
+  lower[lastSpecified] += 1;
+  for (let index = lastSpecified + 1; index < lower.length; index += 1) {
+    lower[index] = 0;
+  }
+  return lower;
 }
 
 /**

package/all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh

@@ -1067,8 +1067,38 @@ readonly AGENT_CREDENTIAL='(\.(claude|codex|cursor|copilot|gemini|antigravity)/[
 # 15d. Dotenv files. `.env.example`, `.sample`, `.template`, `.dist` and
 # `.schema` are checked-in documentation of which keys exist, never the values,
 # so they are excluded — that collision is the one this rule most had to avoid.
-readonly DOTENV_SECRET='(^|[[:space:]='"$qc"'./])\.env(\.[[:alnum:]_-]+)?([[:space:]'"$qc"']|$)'
-readonly DOTENV_PUBLIC='\.env\.(example|sample|template|dist|schema|defaults)([[:space:]'"$qc"']|$)'
+# Decide dotenv privacy per PATH, never by subtracting one command-wide match
+# from another. A command that names `.env.example` and `.env` contains both a
+# public path and a private one; seeing the former cannot authorize the latter.
+#
+# The one write-only shape this guard has always allowed remains explicit:
+# seeding a private dotenv destination from one public template. This is safe
+# because the private path is the destination, not a value being read back.
+has_private_dotenv_path() {
+  dotenv_scan_status=0
+  dotenv_candidates="$(printf '%s' "$normalized_command_str" \
+    | grep -Eio -- '(^|[[:space:]='"$qc"'./])\.env(\.[[:alnum:]_-]+)?')" \
+    || dotenv_scan_status=$?
+  if [ "$dotenv_scan_status" -gt 1 ]; then
+    block "dotenv path classification failed; denying the credential-store read fail-closed."
+  fi
+
+  while IFS= read -r candidate; do
+    [ -n "$candidate" ] || continue
+    candidate="$(printf '%s' "$candidate" \
+      | tr '[:upper:]' '[:lower:]' \
+      | grep -Eo -- '\.env(\.[[:alnum:]_-]+)?')"
+    case "$candidate" in
+      .env.example | .env.sample | .env.template | .env.dist | .env.schema | .env.defaults) ;;
+      *) return 0 ;;
+    esac
+  done <<EOF
+$dotenv_candidates
+EOF
+  return 1
+}
+
+readonly SAFE_DOTENV_SEED='^[[:space:]]*(cp|mv)[[:space:]]+\.env\.(example|sample|template|dist|schema|defaults)[[:space:]]+\.env(\.[[:alnum:]_-]+)?[[:space:]]*$'
 
 if matches "$SECRET_READ_VERB"; then
   if matches "$SSH_PRIVATE_KEY"; then
@@ -1080,10 +1110,10 @@ if matches "$SECRET_READ_VERB"; then
   if matches "$AGENT_CREDENTIAL"; then
     block "reading, copying or transmitting a coding-agent or package-registry credential store. These tokens impersonate the operator to every service the agent can reach."
   fi
-  # `.env` only when the path is NOT one of the public example forms. Ordered as
-  # an exclusion rather than a narrower pattern so a new example suffix is one
-  # word to add, and so the reason a file is exempt stays readable.
-  if matches "$DOTENV_SECRET" && ! matches "$DOTENV_PUBLIC"; then
+  # A public path elsewhere in the command never exempts a private path. The
+  # narrow public-template -> private-destination seed is write-only and remains
+  # allowed; every other command containing a private dotenv path is refused.
+  if has_private_dotenv_path && ! matches "$SAFE_DOTENV_SEED"; then
     block "reading, copying or transmitting a dotenv file holding real values. \`.env.example\`, \`.env.sample\`, \`.env.template\` and \`.env.dist\` are readable, and WRITING a .env is unaffected — only reading one back is refused."
   fi
   # Fail-closed, narrowly. A read whose DIRECTORY is a known credential store

package/all/copy-overwrite/scripts/lisa-postinstall.mjs

@@ -47,7 +47,7 @@
 import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
-import { boundedSpawnSync } from "./lib/bounded-spawn.mjs";
+import { boundedSpawnSync, isChildTimeout } from "./lib/bounded-spawn.mjs";
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 /**
@@ -148,18 +148,40 @@ export function runPostinstall(cwd = process.cwd(), env = process.env) {
     return;
   }
 
-  const child = boundedSpawnSync(
-    process.execPath,
-    [LISA_ENTRY, "--yes", "--skip-git-check", "."],
-    {
-      cwd,
-      env: { ...env, LISA_BOOTSTRAP: "1" },
-      encoding: "utf8",
-      // Inherited, NOT captured-and-discarded. The whole point.
-      stdio: ["ignore", "inherit", "pipe"],
-      timeout: APPLY_BUDGET_MS,
-    }
-  );
+  let child;
+  try {
+    child = boundedSpawnSync(
+      process.execPath,
+      [LISA_ENTRY, "--yes", "--skip-git-check", "."],
+      {
+        cwd,
+        env: { ...env, LISA_BOOTSTRAP: "1" },
+        encoding: "utf8",
+        // Inherited, NOT captured-and-discarded. The whole point.
+        stdio: ["ignore", "inherit", "pipe"],
+        timeout: APPLY_BUDGET_MS,
+      }
+    );
+  } catch (error) {
+    // A timeout is a failed APPLY, not a failed INSTALL. The bounded child
+    // deliberately throws so ordinary callers fail closed; this caller has a
+    // stronger, documented contract to leave a durable marker and let the
+    // package manager finish. Unknown throws still escape because converting a
+    // broken postinstall module into an apparent apply failure would hide the
+    // defect that needs fixing.
+    if (!isChildTimeout(error)) throw error;
+    child = {
+      error: Object.assign(
+        new Error(
+          "Lisa template apply exceeded its ten-minute deadline and was killed."
+        ),
+        { code: "ETIMEDOUT" }
+      ),
+      status: null,
+      stderr:
+        "Lisa template apply exceeded its ten-minute deadline and was killed.\n",
+    };
+  }
 
   const stderr = child.stderr ?? "";
   if (stderr) process.stderr.write(stderr);

package/all/copy-overwrite/scripts/lisa-reconcile-policy.mjs

@@ -718,9 +718,17 @@ export function reconcileContexts({
     if (record.ruleset !== undefined && entry.ruleset !== record.ruleset) {
       return false;
     }
-    return !(
-      record.integration_id !== undefined &&
-      entry.integration_id !== record.integration_id
+    // Configured ruleset policy defaults to GitHub Actions when it carries no
+    // explicit pin. That is the same default the writer applies, so comparison
+    // and repair converge. A gate-derived record names no ruleset and remains
+    // name-only: it never declared which app may satisfy it.
+    if (record.ruleset !== undefined) {
+      const expected = record.integration_id ?? ACTIONS_INTEGRATION_ID;
+      return entry.integration_id === expected;
+    }
+    return (
+      record.integration_id === undefined ||
+      entry.integration_id === record.integration_id
     );
   };
   const unsatisfied = declarations.filter(

package/all/copy-overwrite/scripts/lisa-run-gates.mjs

@@ -358,10 +358,9 @@ function normaliseExec(raw) {
  * ## Two kinds that look eligible and are not
  *
  * `uncaptured` is NOT here, and the attempt to include it is what proves the
- * distinction. Capture is off by default (`LISA_GATES_CAPTURE=1` turns it on),
- * so `uncaptured` is the ORDINARY outcome of an ordinary failing gate — four
- * existing cases went red the moment it was added, every one of them a plain
- * `lint` gate exiting 1. A gate that exited nonzero did measure something; the
+ * distinction. Capture is on by default (`LISA_GATES_CAPTURE=0` turns it off),
+ * so `uncaptured` is an explicit loss of diagnostic evidence rather than the
+ * ordinary outcome. A gate that exited nonzero did measure something; the
  * runner merely did not keep the transcript. Missing evidence about a real
  * failure is not the same claim as a captured transcript that describes no
  * failure at all, which is what `undiagnosed` means.
@@ -888,6 +887,33 @@ const CAPTURE_TAIL_BYTES = 512 * 1024;
  */
 const GATE_COMMAND_BUDGET_MS = 2 * 60 * 60 * 1000;
 
+/** Extra ceiling for the supervisor to reap descendants after its deadline. */
+const PROCESS_TREE_REAP_BUDGET_MS = 10_000;
+
+/** The asynchronous supervisor used behind this synchronous gate API. */
+const PROCESS_TREE_RUNNER = fileURLToPath(
+  new URL("./lib/process-tree-runner.mjs", import.meta.url)
+);
+
+/**
+ * Run a shell command under a process-tree deadline.
+ * @param {string} command Shell source.
+ * @param {object} options Child options passed to the supervisor.
+ * @returns {import("node:child_process").SpawnSyncReturns<string>} Result.
+ */
+function runProcessTree(command, options = {}) {
+  const timeout = options.timeout ?? GATE_COMMAND_BUDGET_MS;
+  const { shell: _shell, ...childOptions } = options;
+  return boundedSpawnSync(
+    process.execPath,
+    [PROCESS_TREE_RUNNER, `--timeout-ms=${timeout}`, "--", command],
+    {
+      ...childOptions,
+      timeout: timeout + PROCESS_TREE_REAP_BUDGET_MS,
+    }
+  );
+}
+
 /**
  * Convert a killed child into this file's no-verdict answer, or re-raise.
  *
@@ -916,8 +942,7 @@ function killedOrRethrow(error) {
  */
 function plainExec(command) {
   try {
-    const child = boundedSpawnSync(command, [], {
-      shell: true,
+    const child = runProcessTree(command, {
       stdio: "inherit",
       timeout: GATE_COMMAND_BUDGET_MS,
     });
@@ -1015,9 +1040,17 @@ export function spawnExec(command) {
   const statusPath = join(dir, "status");
   // Newline-separated inside a group, so a command ending in a trailing
   // comment or redirection still has `echo` run as its own statement.
-  const script = `{\n${command}\necho $? > '${statusPath}'\n} 2>&1 | tee '${logPath}'\n`;
+  // Paths travel as data, never as shell source. A TMPDIR containing a quote,
+  // newline, dollar sign, or command substitution must not be able to break
+  // this wrapper or execute content merely because mkdtemp inherited it.
+  const script = `{\n${command}\necho $? > "$LISA_GATE_STATUS_PATH"\n} 2>&1 | tee "$LISA_GATE_LOG_PATH"\n`;
   try {
-    const child = boundedSpawnSync("sh", ["-c", script], {
+    const child = runProcessTree(script, {
+      env: {
+        ...process.env,
+        LISA_GATE_LOG_PATH: logPath,
+        LISA_GATE_STATUS_PATH: statusPath,
+      },
       stdio: "inherit",
       timeout: GATE_COMMAND_BUDGET_MS,
     });

package/all/copy-overwrite/scripts/lisa-schema-validate.mjs

@@ -150,9 +150,9 @@ function resolveRef(ref, root) {
   const defs = isSchemaObject(root.$defs) ? root.$defs : {};
   const target =
     match && Object.hasOwn(defs, match[1]) ? defs[match[1]] : undefined;
-  if (!target) {
+  if (!isSchemaObject(target)) {
     throw new Error(
-      `unsupported or unresolvable $ref "${ref}" (only #/$defs/<name> is supported)`
+      `unsupported or unresolvable $ref "${ref}" (only #/$defs/<name> resolving to a subschema object is supported)`
     );
   }
   return target;

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -536,7 +536,8 @@ function verifyLevel(config) {
     throw new TrackingError(
       `Unknown workItem.verify '${raw}'. Expected "trailer" (the default: ` +
         `prove the Work-Item reference, contact no tracker) or "full" (also ` +
-        `prove the tracker item's repo scope, claimed state, and PR backlink)`
+        `prove the tracker item exists and is open, has repo scope, is a leaf, ` +
+        `and carries the PR backlink)`
     );
   }
   return value;

package/cdk/package-lisa/package.lisa.json

@@ -8,7 +8,7 @@
       "prepare": "husky install || true",
       "test": "vitest run",
       "test:unit": "vitest run --exclude='**/integration/**'",
-      "test:integration:lisa": "vitest run '.integration.' 'integration/' --passWithNoTests",
+      "test:integration:lisa": "vitest run '.integration.' 'integration/'",
       "test:cov": "vitest run --coverage",
       "test:mutation": "node scripts/lisa-mutation.mjs",
       "test:watch": "vitest",

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAitBjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAonBjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA6tBjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAgoBjC,CAAC"}

package/dist/core/lisa-owned-hash-ledger.js

@@ -287,6 +287,9 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "19412df978489b6e0dfb8fd008d91895af9181bc1e6a7c9df616d9137da3e429",
         "82191900c818a88208669a39563cfed8de1512de699a9ccf7155743e5eff859e",
     ]),
+    "scripts/lib/process-tree-runner.mjs": Object.freeze([
+        "fb68902c68b4cd156f26d2f743364f611a54b833bc445b5144b4c844f553f188",
+    ]),
     "scripts/lisa-clean-git-env.sh": Object.freeze([
         "d15af6f13eedbca41046070972380e69fc0af8f7d903aac12b8644389b9a0c91",
         "e7121a0ee9e1bf7c01cd2ab55f563dd6d9ab75990739bb6ddf571a513efa10e9",
@@ -333,11 +336,13 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "f936bc8a038a7901ade1ba58cc52e5f5a8b8b2a52a9f0c1516567cc80eb02ccb",
     ]),
     "scripts/lisa-floor-collisions.mjs": Object.freeze([
+        "04f9455319a501112902794874ca4889feff8c0d9c04cc07fb5720b09ed8fc92",
         "16f609ebf97f4f52e462ed97a774c2b56a33a99865cc11a5c069fbbbb45b007c",
         "2d11968f6852ab745cba939de03c6d6cb5f413975d2cfc8fc447bdd0b218e91a",
         "3136d9c30b9f2945c555c0545fc9dac5ebf9135bda5e89330e351b4313ee8b89",
         "3c7a0234b4f5609fce49e44711d2ec86af8cf7fb82b0831e4450e3347ecefe45",
         "41060648b4394d417528f4f560a52f296b4df5b6ec8a5633e08afe4588b6a088",
+        "557065f223dfc0715a20c3de76bafee0aefe22f52385c52e17cfc7b9398cce2d",
         "8870dba7b299ddb528e01fee32ec01cd8994a72118708ea8d3255be3daedfa72",
         "9cba6e0103c27850703323da25ac149c0136225172f1a1640abe3b3ac4e50a8e",
         "a612f172282d13ba9318fe5e03689d7c6ff42a0122d0c9d5d39051e1967b93dc",
@@ -533,6 +538,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "1d4fbe135f1bb4e861d286a6512ed201d4522250dfe3f9eba6584bc5ff166a95",
         "2b1ca7d317dea3af106df1a74b1718e3df9c18e76e9d9d769aa3271b7abf8a3f",
         "388cf8847581d96a1ff8ea98290a33a5f96d67cdd502ea807a0b8d88efe90e19",
+        "450338257697a75a8fce9f06f3fc00bf3417947e50d601794da41f9c520a7cc3",
         "64546813f168fb446f39e34bc674fd3af85b15bd5e7f4f6bf4503463e701a7b9",
         "74b5b90fcf15dbeb14a69677cf74e339154421cd056fdaf603d1167b34a74105",
         "772202ddd42d626625ff719666afbbe83445d8bae1bc7c0fb5ffdcb402be83f8",
@@ -589,6 +595,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "eb3593f201f570db63a9568236446d4324ee8757cda5e234965f3278d653c7db",
     ]),
     "scripts/lisa-postinstall.mjs": Object.freeze([
+        "3294f390878d7fdb74417e12e9d386027ea8baeb874c5cae56c6d44d1df6261d",
         "45cf63bc37ef1115bc47e8212c709a7ec4dc09a9d7541297f0e2f090cbfb1fcc",
         "864bfbdc0b089a9b97e7ff053716f52e813071faff0be220294767b65918967b",
         "98fe3adf3192a72f40eb75757193ce866f0a6123387377f6041e54d938df8d96",
@@ -599,6 +606,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "07542e977ed41f094d5a51cae512e4a3246fabe10d0f83676a176abc81d91624",
         "1e8053bb51a01fda0e2489de231ea252473991138da150dbdff72c5292e1ce53",
         "2512f61074d10216dee0aca748caaebad373e6bba2598bc089f30f977c7a6a83",
+        "395897d1dc3f0ac92d7c892eaa9b9ddf12078181bb9f5b228965478190b09a91",
         "3c062d0b79961a9a93a822507e893dcdaa71d65d735557727d20464c2489d812",
         "3e67eb4b0710ec195ad7efa4a8c2fd64063897d67725ea2627cf869c7e066201",
         "4b383ff960d7da53e0dd46e37632ef55c5a38b004fb4aabfe91a25a9fe02d88f",
@@ -629,6 +637,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "6e419a489d0605cc0743af207ff4ff3428d8bcdfbabb7207d164593b9644dfa5",
         "79055f89eb9c5bf1739867c12dc2d9e30320f86a2a3dd470300ba706c3c9d85e",
         "94453bdae8ab3dd2eba0883c4b278027396090e0bdc8e2f102414abc6415912a",
+        "9b14c8864608e8ca390579048229bc0bbaba3094af0b536f1956085295c68af3",
         "9fa363107aa5ff033f150ff1a1bb5550d286de383b3d1f7b6c2ac2947730c8f2",
         "a58af06f1d677d82b780a6857916c1684a44649ba742b2b329d408057ae5700d",
         "ba610745a8878bb9a21af249d6ab5b384fcf88e7c530db846f4f8163faba7a8e",
@@ -647,6 +656,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "08cb25c2c49e0e5fd01e29861bbb8c90f612f9736ca2df86789fa72bd26d271e",
         "2ace82daacdebbbb00a7eceb09fbe82cabec04330a083ca10417b2ee4e0a63eb",
         "3119c557eb49776143f0a4a715a25a2918242baccf39b7660a63d376e4e79791",
+        "34d751e4ee98c14ae1c76ae14fe3da1ca913f70f40019a8423733f03ab64bb89",
         "4a05a0ed70a274827fd2f0fd0c98890c66bee2fde70785b8379943ebe6650473",
         "83c6e57e8168c5ae9fe538b23eec9016d0c959a4b5470d1ab160562ec2815de3",
         "8a1684f5c2b4d37fc782d2090273772814f7ad6c61e7ae5459163a1f28b7a5dc",
@@ -665,6 +675,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "238dc2da29938edd92518c2b08192d14c6f2751ed175c07d6e882814829b7b7e",
         "2d9ca0841db9e75ddfd95e3a4d485fd01aa639a512ef648996f565b7991d8e2b",
         "4c263fef48c03b3b6c623ea8a6cd55505bfaf28197e5072226ea35f9f3d26885",
+        "5a0b82045d9795284a109c28e5e9dd97a5488ff540bb7034b84077d1447ffd7c",
         "5eb31c284e820a51312d4484f0669128007326af55ee515923fec33700d003a1",
         "637741a9e5d2904aed24d48efd6bec1326c5573f718a13152807aa0e4b42f0a1",
         "6a8be8577242588f14ab52b25b2a22b6def53aefa9513b4d3d7c49f4d8027079",
@@ -721,6 +732,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "cf99167b05d210afad01fb41fc4aed548c66ee0e9a7c4decb8afa1f180eb5640",
     ]),
     "scripts/threshold-ratchet-families.mjs": Object.freeze([
+        "39cb2fb53f1cc939675e7f8d5530a760abac420c2259fc97108d21f15c0275e9",
         "47d44b2bca383ae395b4e415e06c97a127327ab13762ee95b8c43d0198639bbb",
         "8fa58cc7276add0b2edf1de92bdcc32d81d840811ef0614ddc724010b59a888c",
         "93190f926689725418c1ec9eae15c55910b128cff6e3cb10185e466c7b90cc4f",
@@ -1002,6 +1014,9 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "19412df978489b6e0dfb8fd008d91895af9181bc1e6a7c9df616d9137da3e429",
         "82191900c818a88208669a39563cfed8de1512de699a9ccf7155743e5eff859e",
     ]),
+    "scripts/lib/process-tree-runner.mjs": Object.freeze([
+        "fb68902c68b4cd156f26d2f743364f611a54b833bc445b5144b4c844f553f188",
+    ]),
     "scripts/lisa-clean-git-env.sh": Object.freeze([
         "d15af6f13eedbca41046070972380e69fc0af8f7d903aac12b8644389b9a0c91",
         "e7121a0ee9e1bf7c01cd2ab55f563dd6d9ab75990739bb6ddf571a513efa10e9",
@@ -1047,10 +1062,12 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "f936bc8a038a7901ade1ba58cc52e5f5a8b8b2a52a9f0c1516567cc80eb02ccb",
     ]),
     "scripts/lisa-floor-collisions.mjs": Object.freeze([
+        "04f9455319a501112902794874ca4889feff8c0d9c04cc07fb5720b09ed8fc92",
         "16f609ebf97f4f52e462ed97a774c2b56a33a99865cc11a5c069fbbbb45b007c",
         "2d11968f6852ab745cba939de03c6d6cb5f413975d2cfc8fc447bdd0b218e91a",
         "3c7a0234b4f5609fce49e44711d2ec86af8cf7fb82b0831e4450e3347ecefe45",
         "41060648b4394d417528f4f560a52f296b4df5b6ec8a5633e08afe4588b6a088",
+        "557065f223dfc0715a20c3de76bafee0aefe22f52385c52e17cfc7b9398cce2d",
         "8870dba7b299ddb528e01fee32ec01cd8994a72118708ea8d3255be3daedfa72",
         "9cba6e0103c27850703323da25ac149c0136225172f1a1640abe3b3ac4e50a8e",
         "a612f172282d13ba9318fe5e03689d7c6ff42a0122d0c9d5d39051e1967b93dc",
@@ -1202,6 +1219,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "1bf3512bb94923a6cb25b1e7a619a3fc8e1336bffa16f499b459aaee3eaed66d",
         "1d4fbe135f1bb4e861d286a6512ed201d4522250dfe3f9eba6584bc5ff166a95",
         "388cf8847581d96a1ff8ea98290a33a5f96d67cdd502ea807a0b8d88efe90e19",
+        "450338257697a75a8fce9f06f3fc00bf3417947e50d601794da41f9c520a7cc3",
         "64546813f168fb446f39e34bc674fd3af85b15bd5e7f4f6bf4503463e701a7b9",
         "74b5b90fcf15dbeb14a69677cf74e339154421cd056fdaf603d1167b34a74105",
         "772202ddd42d626625ff719666afbbe83445d8bae1bc7c0fb5ffdcb402be83f8",
@@ -1249,6 +1267,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "eb3593f201f570db63a9568236446d4324ee8757cda5e234965f3278d653c7db",
     ]),
     "scripts/lisa-postinstall.mjs": Object.freeze([
+        "3294f390878d7fdb74417e12e9d386027ea8baeb874c5cae56c6d44d1df6261d",
         "45cf63bc37ef1115bc47e8212c709a7ec4dc09a9d7541297f0e2f090cbfb1fcc",
         "864bfbdc0b089a9b97e7ff053716f52e813071faff0be220294767b65918967b",
         "98fe3adf3192a72f40eb75757193ce866f0a6123387377f6041e54d938df8d96",
@@ -1256,6 +1275,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
     ]),
     "scripts/lisa-reconcile-policy.mjs": Object.freeze([
         "2512f61074d10216dee0aca748caaebad373e6bba2598bc089f30f977c7a6a83",
+        "395897d1dc3f0ac92d7c892eaa9b9ddf12078181bb9f5b228965478190b09a91",
         "3c062d0b79961a9a93a822507e893dcdaa71d65d735557727d20464c2489d812",
         "3e67eb4b0710ec195ad7efa4a8c2fd64063897d67725ea2627cf869c7e066201",
         "5c6b8a6ff3010b11f78b70eda0e73e78e1155b634a781b8abec79e40ac286eb7",
@@ -1281,6 +1301,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "6e419a489d0605cc0743af207ff4ff3428d8bcdfbabb7207d164593b9644dfa5",
         "79055f89eb9c5bf1739867c12dc2d9e30320f86a2a3dd470300ba706c3c9d85e",
         "94453bdae8ab3dd2eba0883c4b278027396090e0bdc8e2f102414abc6415912a",
+        "9b14c8864608e8ca390579048229bc0bbaba3094af0b536f1956085295c68af3",
         "9fa363107aa5ff033f150ff1a1bb5550d286de383b3d1f7b6c2ac2947730c8f2",
         "ba610745a8878bb9a21af249d6ab5b384fcf88e7c530db846f4f8163faba7a8e",
         "beffca5715f5c1309efd95d7a4895a980ae48498501c0cff163820ed5530730f",
@@ -1296,6 +1317,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "08cb25c2c49e0e5fd01e29861bbb8c90f612f9736ca2df86789fa72bd26d271e",
         "2ace82daacdebbbb00a7eceb09fbe82cabec04330a083ca10417b2ee4e0a63eb",
         "3119c557eb49776143f0a4a715a25a2918242baccf39b7660a63d376e4e79791",
+        "34d751e4ee98c14ae1c76ae14fe3da1ca913f70f40019a8423733f03ab64bb89",
         "4a05a0ed70a274827fd2f0fd0c98890c66bee2fde70785b8379943ebe6650473",
         "8a1684f5c2b4d37fc782d2090273772814f7ad6c61e7ae5459163a1f28b7a5dc",
         "9dd145c0f9dac6ed252b13d32e130dbab964da6cd357981b58541780ecb2f981",
@@ -1312,6 +1334,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "238dc2da29938edd92518c2b08192d14c6f2751ed175c07d6e882814829b7b7e",
         "2d9ca0841db9e75ddfd95e3a4d485fd01aa639a512ef648996f565b7991d8e2b",
         "4c263fef48c03b3b6c623ea8a6cd55505bfaf28197e5072226ea35f9f3d26885",
+        "5a0b82045d9795284a109c28e5e9dd97a5488ff540bb7034b84077d1447ffd7c",
         "5eb31c284e820a51312d4484f0669128007326af55ee515923fec33700d003a1",
         "6a8be8577242588f14ab52b25b2a22b6def53aefa9513b4d3d7c49f4d8027079",
         "71ff42c2cb8ac7022e0066132476764dd745fb92bf19ccd395000b1fe319abc7",
@@ -1365,6 +1388,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "cf99167b05d210afad01fb41fc4aed548c66ee0e9a7c4decb8afa1f180eb5640",
     ]),
     "scripts/threshold-ratchet-families.mjs": Object.freeze([
+        "39cb2fb53f1cc939675e7f8d5530a760abac420c2259fc97108d21f15c0275e9",
         "47d44b2bca383ae395b4e415e06c97a127327ab13762ee95b8c43d0198639bbb",
         "8fa58cc7276add0b2edf1de92bdcc32d81d840811ef0614ddc724010b59a888c",
         "93190f926689725418c1ec9eae15c55910b128cff6e3cb10185e466c7b90cc4f",