@codyswann/lisa 4.22.9 → 4.22.11

package/all/copy-overwrite/scripts/check-release-package-identity.mjs

@@ -90,6 +90,33 @@ function tarMember(tarballPath, member) {
   }
 }
 
+/** Create the one npm archive whose bytes will be published. */
+function createCandidateArchive(root, packDestination) {
+  mkdirSync(packDestination, { recursive: true });
+  if (readdirSync(packDestination).length !== 0) {
+    mismatch(`pack destination must be empty (${packDestination})`);
+  }
+  try {
+    return String(
+      boundedExecFileSync(
+        "npm",
+        [
+          "pack",
+          "--ignore-scripts",
+          "--silent",
+          "--pack-destination",
+          packDestination,
+        ],
+        { cwd: root, encoding: "utf8", timeout: 120_000 }
+      )
+    );
+  } catch (error) {
+    mismatch(
+      `npm pack failed before publication (${error instanceof Error ? error.message : String(error)})`
+    );
+  }
+}
+
 /** Extract the one workspace package version certified by generated bytes. */
 function certificateVersion(bytes, label) {
   const match = String(bytes).match(
@@ -115,18 +142,24 @@ export function assertReleaseCommit(releaseCommit) {
  * @returns {{headCommit: string, tagCommit: string, releaseCommit: string}}
  */
 export function assertCheckoutIdentity({ root, releaseCommit, tag }) {
-  assertReleaseCommit(releaseCommit);
+  const validatedReleaseCommit = assertReleaseCommit(releaseCommit);
   const headCommit = gitCommit(root, "HEAD");
-  if (headCommit !== releaseCommit) {
+  if (headCommit !== validatedReleaseCommit) {
     mismatch(
-      `HEAD ${headCommit} does not match release commit ${releaseCommit}`
+      `HEAD ${headCommit} does not match release commit ${validatedReleaseCommit}`
     );
   }
   const tagCommit = gitCommit(root, tag);
-  if (tagCommit !== releaseCommit) {
-    mismatch(`tag ${tag} resolves ${tagCommit}, expected ${releaseCommit}`);
+  if (tagCommit !== validatedReleaseCommit) {
+    mismatch(
+      `tag ${tag} resolves ${tagCommit}, expected ${validatedReleaseCommit}`
+    );
   }
-  return Object.freeze({ headCommit, tagCommit, releaseCommit });
+  return Object.freeze({
+    headCommit,
+    tagCommit,
+    releaseCommit: validatedReleaseCommit,
+  });
 }
 
 /**
@@ -140,21 +173,21 @@ export function packAndValidateReleaseCandidate({
   releaseCommit,
   packDestination,
 }) {
-  assertReleaseCommit(releaseCommit);
+  const validatedReleaseCommit = assertReleaseCommit(releaseCommit);
   const packageJson = readJson(path.join(root, "package.json"), "package.json");
   if (packageJson.version !== version) {
     mismatch(
       `package.json version ${JSON.stringify(packageJson.version)} expected ${version}`
     );
   }
-  if (packageJson.lisaReleaseCommit !== releaseCommit) {
+  if (packageJson.lisaReleaseCommit !== validatedReleaseCommit) {
     mismatch(
-      `package.json lisaReleaseCommit ${JSON.stringify(packageJson.lisaReleaseCommit)} expected ${releaseCommit}`
+      `package.json lisaReleaseCommit ${JSON.stringify(packageJson.lisaReleaseCommit)} expected ${validatedReleaseCommit}`
     );
   }
-  if (packageJson.gitHead !== releaseCommit) {
+  if (packageJson.gitHead !== validatedReleaseCommit) {
     mismatch(
-      `package.json gitHead ${JSON.stringify(packageJson.gitHead)} expected ${releaseCommit}`
+      `package.json gitHead ${JSON.stringify(packageJson.gitHead)} expected ${validatedReleaseCommit}`
     );
   }
 
@@ -172,30 +205,7 @@ export function packAndValidateReleaseCandidate({
     }
   }
 
-  mkdirSync(packDestination, { recursive: true });
-  if (readdirSync(packDestination).length !== 0) {
-    mismatch(`pack destination must be empty (${packDestination})`);
-  }
-  let packOutput;
-  try {
-    packOutput = String(
-      boundedExecFileSync(
-        "npm",
-        [
-          "pack",
-          "--ignore-scripts",
-          "--silent",
-          "--pack-destination",
-          packDestination,
-        ],
-        { cwd: root, encoding: "utf8", timeout: 120_000 }
-      )
-    );
-  } catch (error) {
-    mismatch(
-      `npm pack failed before publication (${error instanceof Error ? error.message : String(error)})`
-    );
-  }
+  const packOutput = createCandidateArchive(root, packDestination);
   const candidates = readdirSync(packDestination).filter(file =>
     file.endsWith(".tgz")
   );
@@ -223,14 +233,14 @@ export function packAndValidateReleaseCandidate({
       `packed package version ${JSON.stringify(packedPackage.version)} expected ${version}`
     );
   }
-  if (packedPackage.lisaReleaseCommit !== releaseCommit) {
+  if (packedPackage.lisaReleaseCommit !== validatedReleaseCommit) {
     mismatch(
-      `packed lisaReleaseCommit ${JSON.stringify(packedPackage.lisaReleaseCommit)} expected ${releaseCommit}`
+      `packed lisaReleaseCommit ${JSON.stringify(packedPackage.lisaReleaseCommit)} expected ${validatedReleaseCommit}`
     );
   }
-  if (packedPackage.gitHead !== releaseCommit) {
+  if (packedPackage.gitHead !== validatedReleaseCommit) {
     mismatch(
-      `packed gitHead ${JSON.stringify(packedPackage.gitHead)} expected ${releaseCommit}`
+      `packed gitHead ${JSON.stringify(packedPackage.gitHead)} expected ${validatedReleaseCommit}`
     );
   }
 
@@ -241,7 +251,7 @@ export function packAndValidateReleaseCandidate({
     packedCertificateVersion = certificateVersion(member, "packed certificate");
     if (packedCertificateVersion !== version) {
       mismatch(
-        `packed certificate names ${packedCertificateVersion}, expected ${version} at release commit ${releaseCommit} (${PACKED_CERTIFICATE})`
+        `packed certificate names ${packedCertificateVersion}, expected ${version} at release commit ${validatedReleaseCommit} (${PACKED_CERTIFICATE})`
       );
     }
     certificateMemberSha256 = sha256(member);
@@ -249,7 +259,7 @@ export function packAndValidateReleaseCandidate({
 
   return Object.freeze({
     version,
-    releaseCommit,
+    releaseCommit: validatedReleaseCommit,
     certificateVersion: packedCertificateVersion,
     tarballPath,
     tarballSha256: sha256(tarballBytes),

package/all/copy-overwrite/scripts/lib/process-tree-runner.mjs

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/**
+ * Run one shell command in its own process group and reap the whole group.
+ *
+ * Node's synchronous timeout signals only the direct child. A gate command is
+ * a tree (shell, package manager, test workers), so killing only the shell
+ * leaves descendants running against scratch state the caller then removes.
+ * This small asynchronous supervisor is invoked through a synchronous parent:
+ * it owns the process-group id, applies the deadline, terminates the group, and
+ * only then lets the parent continue.
+ * @module scripts/lib/process-tree-runner
+ */
+
+import { spawn, spawnSync } from "node:child_process";
+
+import { invokedAsScript } from "./invoked-as-script.mjs";
+
+const KILL_GRACE_MS = 750;
+
+function parseArguments(argv) {
+  const timeoutArg = argv.find(value => value.startsWith("--timeout-ms="));
+  const separator = argv.indexOf("--");
+  const timeoutMs = Number(timeoutArg?.slice("--timeout-ms=".length));
+  const command = separator >= 0 ? argv.slice(separator + 1).join(" ") : "";
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || !command) {
+    throw new Error(
+      "usage: process-tree-runner.mjs --timeout-ms=<positive-ms> -- <command>"
+    );
+  }
+  return { command, timeoutMs };
+}
+
+function killTree(pid, signal) {
+  if (process.platform === "win32") {
+    // Windows has no negative-pid process groups. taskkill /T is the native
+    // tree primitive; /F is used only for the escalation.
+    const args = ["/pid", String(pid), "/T"];
+    if (signal === "SIGKILL") args.push("/F");
+    spawnSync("taskkill", args, { stdio: "ignore", timeout: KILL_GRACE_MS });
+    return;
+  }
+  try {
+    process.kill(-pid, signal);
+  } catch {
+    // ESRCH means the whole group already exited.
+  }
+}
+
+export function supervise(command, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const shell =
+      process.platform === "win32"
+        ? process.env.ComSpec || "cmd.exe"
+        : "/bin/sh";
+    const shellArgs =
+      process.platform === "win32"
+        ? ["/d", "/s", "/c", command]
+        : ["-c", command];
+    const child = spawn(shell, shellArgs, {
+      detached: true,
+      env: process.env,
+      stdio: "inherit",
+    });
+    const pid = child.pid;
+    if (pid === undefined) {
+      reject(new Error("gate process tree did not start"));
+      return;
+    }
+
+    let timedOut = false;
+    let settled = false;
+    const finish = (code, signal) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(deadline);
+      // A command may leave a background descendant after its direct shell
+      // exits. Reap that residue before returning a verdict too.
+      killTree(pid, "SIGTERM");
+      resolve({ code, signal });
+    };
+
+    const deadline = setTimeout(() => {
+      timedOut = true;
+      killTree(pid, "SIGTERM");
+      setTimeout(() => {
+        killTree(pid, "SIGKILL");
+        // A signal-shaped result is the existing gate runner vocabulary for
+        // "no verdict". It also prevents an ordinary exit code such as 124
+        // from being confused with a user command that returned that code.
+        if (process.platform === "win32") {
+          process.exit(124);
+        } else {
+          process.kill(process.pid, "SIGKILL");
+        }
+      }, KILL_GRACE_MS);
+    }, timeoutMs);
+
+    child.once("error", error => {
+      clearTimeout(deadline);
+      killTree(pid, "SIGKILL");
+      reject(error);
+    });
+    child.once("close", (code, signal) => {
+      // On timeout, wait for the forced group reap above before this supervisor
+      // ends. Exiting on the direct shell's close is the race that used to leave
+      // its descendants alive.
+      if (!timedOut) finish(code, signal);
+    });
+  });
+}
+
+async function main() {
+  const { command, timeoutMs } = parseArguments(process.argv.slice(2));
+  const result = await supervise(command, timeoutMs);
+  if (result.signal) {
+    process.exitCode = 128;
+  } else {
+    process.exitCode = result.code ?? 1;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
+  await main();
+}

package/all/copy-overwrite/scripts/lisa-floor-collisions.mjs

@@ -85,11 +85,45 @@ const DEPENDENCY_SECTIONS = [
  * means: `^8` is `>=8.0.0 <9.0.0` and `1.x` is `>=1.0.0 <2.0.0`. Only the lower
  * bound is read here, so the upper half costs nothing to ignore.
  *
- * Still one left-to-right pass: the optional groups each have a literal `.`
- * ahead of them, so there is no position at which the engine has two viable
- * ways to match and nothing to backtrack over (S5852).
+ * This parser deliberately uses no version-shaped regular expression. The
+ * collision gate consumes dependency text supplied by a repository, so even a
+ * bounded-looking optional-group expression becomes an avoidable ReDoS review
+ * burden. A tiny left-to-right scanner is both clearer and constant-work per
+ * input character.
  */
-const BRANCH_VERSION = /^[\sv=><~^]*(\d+)(?:\.(\d+))?(?:\.(\d+))?/;
+function parseBranchVersion(branch) {
+  let cursor = branch.trimStart();
+  while (cursor.startsWith("v")) cursor = cursor.slice(1);
+
+  const operator = [">=", ">", "=", "^", "~"].find(candidate =>
+    cursor.startsWith(candidate)
+  );
+  if (operator) cursor = cursor.slice(operator.length);
+  cursor = cursor.trimStart();
+
+  let end = 0;
+  while (end < cursor.length) {
+    const character = cursor[end];
+    const digit = character >= "0" && character <= "9";
+    const next = cursor[end + 1];
+    const componentSeparator = character === "." && next >= "0" && next <= "9";
+    if (!digit && !componentSeparator) break;
+    end += 1;
+  }
+
+  const parts = cursor.slice(0, end).split(".");
+  if (
+    parts.length > 3 ||
+    parts.some(
+      part =>
+        part === "" ||
+        [...part].some(character => character < "0" || character > "9")
+    )
+  ) {
+    return null;
+  }
+  return { operator, parts };
+}
 
 /**
  * Lowest version a single disjunction branch permits.
@@ -104,13 +138,34 @@ const BRANCH_VERSION = /^[\sv=><~^]*(\d+)(?:\.(\d+))?(?:\.(\d+))?/;
 function branchLowerBound(branch) {
   const trimmed = branch.trim();
   if (trimmed === "") return null;
-  if (/^<=?\s*\d/.test(trimmed)) return [0, 0, 0];
-  const match = BRANCH_VERSION.exec(trimmed);
-  if (!match) return null;
+  const upperOperand = trimmed
+    .slice(trimmed.startsWith("<=") ? 2 : 1)
+    .trimStart();
+  if (
+    trimmed.startsWith("<") &&
+    upperOperand[0] >= "0" &&
+    upperOperand[0] <= "9"
+  ) {
+    return [0, 0, 0];
+  }
+  const parsed = parseBranchVersion(trimmed);
+  if (!parsed) return null;
   // An absent minor or patch is zero, not missing: `^8` is `>=8.0.0`. Number()
   // of undefined is NaN, which would compare as neither higher nor lower than
   // anything and quietly disable the comparison it feeds.
-  return [match[1], match[2] ?? "0", match[3] ?? "0"].map(Number);
+  const lower = [...parsed.parts, "0", "0"].slice(0, 3).map(Number);
+  if (parsed.operator !== ">") return lower;
+
+  // npm expands a STRICT comparator on a partial version before comparing:
+  // `>1` is `>=2.0.0` and `>1.2` is `>=1.3.0`. Reading either as merely
+  // 1.0.0/1.2.0 invents versions the range does not permit and can report an
+  // adequate dependency line as weaker than its override.
+  const lastSpecified = parsed.parts.length - 1;
+  lower[lastSpecified] += 1;
+  for (let index = lastSpecified + 1; index < lower.length; index += 1) {
+    lower[index] = 0;
+  }
+  return lower;
 }
 
 /**

package/all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh

@@ -1067,8 +1067,38 @@ readonly AGENT_CREDENTIAL='(\.(claude|codex|cursor|copilot|gemini|antigravity)/[
 # 15d. Dotenv files. `.env.example`, `.sample`, `.template`, `.dist` and
 # `.schema` are checked-in documentation of which keys exist, never the values,
 # so they are excluded — that collision is the one this rule most had to avoid.
-readonly DOTENV_SECRET='(^|[[:space:]='"$qc"'./])\.env(\.[[:alnum:]_-]+)?([[:space:]'"$qc"']|$)'
-readonly DOTENV_PUBLIC='\.env\.(example|sample|template|dist|schema|defaults)([[:space:]'"$qc"']|$)'
+# Decide dotenv privacy per PATH, never by subtracting one command-wide match
+# from another. A command that names `.env.example` and `.env` contains both a
+# public path and a private one; seeing the former cannot authorize the latter.
+#
+# The one write-only shape this guard has always allowed remains explicit:
+# seeding a private dotenv destination from one public template. This is safe
+# because the private path is the destination, not a value being read back.
+has_private_dotenv_path() {
+  dotenv_scan_status=0
+  dotenv_candidates="$(printf '%s' "$normalized_command_str" \
+    | grep -Eio -- '(^|[[:space:]='"$qc"'./])\.env(\.[[:alnum:]_-]+)?')" \
+    || dotenv_scan_status=$?
+  if [ "$dotenv_scan_status" -gt 1 ]; then
+    block "dotenv path classification failed; denying the credential-store read fail-closed."
+  fi
+
+  while IFS= read -r candidate; do
+    [ -n "$candidate" ] || continue
+    candidate="$(printf '%s' "$candidate" \
+      | tr '[:upper:]' '[:lower:]' \
+      | grep -Eo -- '\.env(\.[[:alnum:]_-]+)?')"
+    case "$candidate" in
+      .env.example | .env.sample | .env.template | .env.dist | .env.schema | .env.defaults) ;;
+      *) return 0 ;;
+    esac
+  done <<EOF
+$dotenv_candidates
+EOF
+  return 1
+}
+
+readonly SAFE_DOTENV_SEED='^[[:space:]]*(cp|mv)[[:space:]]+\.env\.(example|sample|template|dist|schema|defaults)[[:space:]]+\.env(\.[[:alnum:]_-]+)?[[:space:]]*$'
 
 if matches "$SECRET_READ_VERB"; then
   if matches "$SSH_PRIVATE_KEY"; then
@@ -1080,10 +1110,10 @@ if matches "$SECRET_READ_VERB"; then
   if matches "$AGENT_CREDENTIAL"; then
     block "reading, copying or transmitting a coding-agent or package-registry credential store. These tokens impersonate the operator to every service the agent can reach."
   fi
-  # `.env` only when the path is NOT one of the public example forms. Ordered as
-  # an exclusion rather than a narrower pattern so a new example suffix is one
-  # word to add, and so the reason a file is exempt stays readable.
-  if matches "$DOTENV_SECRET" && ! matches "$DOTENV_PUBLIC"; then
+  # A public path elsewhere in the command never exempts a private path. The
+  # narrow public-template -> private-destination seed is write-only and remains
+  # allowed; every other command containing a private dotenv path is refused.
+  if has_private_dotenv_path && ! matches "$SAFE_DOTENV_SEED"; then
     block "reading, copying or transmitting a dotenv file holding real values. \`.env.example\`, \`.env.sample\`, \`.env.template\` and \`.env.dist\` are readable, and WRITING a .env is unaffected — only reading one back is refused."
   fi
   # Fail-closed, narrowly. A read whose DIRECTORY is a known credential store

package/all/copy-overwrite/scripts/lisa-postinstall.mjs

@@ -47,7 +47,7 @@
 import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
-import { boundedSpawnSync } from "./lib/bounded-spawn.mjs";
+import { boundedSpawnSync, isChildTimeout } from "./lib/bounded-spawn.mjs";
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 /**
@@ -148,18 +148,40 @@ export function runPostinstall(cwd = process.cwd(), env = process.env) {
     return;
   }
 
-  const child = boundedSpawnSync(
-    process.execPath,
-    [LISA_ENTRY, "--yes", "--skip-git-check", "."],
-    {
-      cwd,
-      env: { ...env, LISA_BOOTSTRAP: "1" },
-      encoding: "utf8",
-      // Inherited, NOT captured-and-discarded. The whole point.
-      stdio: ["ignore", "inherit", "pipe"],
-      timeout: APPLY_BUDGET_MS,
-    }
-  );
+  let child;
+  try {
+    child = boundedSpawnSync(
+      process.execPath,
+      [LISA_ENTRY, "--yes", "--skip-git-check", "."],
+      {
+        cwd,
+        env: { ...env, LISA_BOOTSTRAP: "1" },
+        encoding: "utf8",
+        // Inherited, NOT captured-and-discarded. The whole point.
+        stdio: ["ignore", "inherit", "pipe"],
+        timeout: APPLY_BUDGET_MS,
+      }
+    );
+  } catch (error) {
+    // A timeout is a failed APPLY, not a failed INSTALL. The bounded child
+    // deliberately throws so ordinary callers fail closed; this caller has a
+    // stronger, documented contract to leave a durable marker and let the
+    // package manager finish. Unknown throws still escape because converting a
+    // broken postinstall module into an apparent apply failure would hide the
+    // defect that needs fixing.
+    if (!isChildTimeout(error)) throw error;
+    child = {
+      error: Object.assign(
+        new Error(
+          "Lisa template apply exceeded its ten-minute deadline and was killed."
+        ),
+        { code: "ETIMEDOUT" }
+      ),
+      status: null,
+      stderr:
+        "Lisa template apply exceeded its ten-minute deadline and was killed.\n",
+    };
+  }
 
   const stderr = child.stderr ?? "";
   if (stderr) process.stderr.write(stderr);

package/all/copy-overwrite/scripts/lisa-reconcile-policy.mjs

@@ -718,9 +718,17 @@ export function reconcileContexts({
     if (record.ruleset !== undefined && entry.ruleset !== record.ruleset) {
       return false;
     }
-    return !(
-      record.integration_id !== undefined &&
-      entry.integration_id !== record.integration_id
+    // Configured ruleset policy defaults to GitHub Actions when it carries no
+    // explicit pin. That is the same default the writer applies, so comparison
+    // and repair converge. A gate-derived record names no ruleset and remains
+    // name-only: it never declared which app may satisfy it.
+    if (record.ruleset !== undefined) {
+      const expected = record.integration_id ?? ACTIONS_INTEGRATION_ID;
+      return entry.integration_id === expected;
+    }
+    return (
+      record.integration_id === undefined ||
+      entry.integration_id === record.integration_id
     );
   };
   const unsatisfied = declarations.filter(

package/all/copy-overwrite/scripts/lisa-run-gates.mjs

@@ -358,10 +358,9 @@ function normaliseExec(raw) {
  * ## Two kinds that look eligible and are not
  *
  * `uncaptured` is NOT here, and the attempt to include it is what proves the
- * distinction. Capture is off by default (`LISA_GATES_CAPTURE=1` turns it on),
- * so `uncaptured` is the ORDINARY outcome of an ordinary failing gate — four
- * existing cases went red the moment it was added, every one of them a plain
- * `lint` gate exiting 1. A gate that exited nonzero did measure something; the
+ * distinction. Capture is on by default (`LISA_GATES_CAPTURE=0` turns it off),
+ * so `uncaptured` is an explicit loss of diagnostic evidence rather than the
+ * ordinary outcome. A gate that exited nonzero did measure something; the
  * runner merely did not keep the transcript. Missing evidence about a real
  * failure is not the same claim as a captured transcript that describes no
  * failure at all, which is what `undiagnosed` means.
@@ -888,6 +887,33 @@ const CAPTURE_TAIL_BYTES = 512 * 1024;
  */
 const GATE_COMMAND_BUDGET_MS = 2 * 60 * 60 * 1000;
 
+/** Extra ceiling for the supervisor to reap descendants after its deadline. */
+const PROCESS_TREE_REAP_BUDGET_MS = 10_000;
+
+/** The asynchronous supervisor used behind this synchronous gate API. */
+const PROCESS_TREE_RUNNER = fileURLToPath(
+  new URL("./lib/process-tree-runner.mjs", import.meta.url)
+);
+
+/**
+ * Run a shell command under a process-tree deadline.
+ * @param {string} command Shell source.
+ * @param {object} options Child options passed to the supervisor.
+ * @returns {import("node:child_process").SpawnSyncReturns<string>} Result.
+ */
+function runProcessTree(command, options = {}) {
+  const timeout = options.timeout ?? GATE_COMMAND_BUDGET_MS;
+  const { shell: _shell, ...childOptions } = options;
+  return boundedSpawnSync(
+    process.execPath,
+    [PROCESS_TREE_RUNNER, `--timeout-ms=${timeout}`, "--", command],
+    {
+      ...childOptions,
+      timeout: timeout + PROCESS_TREE_REAP_BUDGET_MS,
+    }
+  );
+}
+
 /**
  * Convert a killed child into this file's no-verdict answer, or re-raise.
  *
@@ -916,8 +942,7 @@ function killedOrRethrow(error) {
  */
 function plainExec(command) {
   try {
-    const child = boundedSpawnSync(command, [], {
-      shell: true,
+    const child = runProcessTree(command, {
       stdio: "inherit",
       timeout: GATE_COMMAND_BUDGET_MS,
     });
@@ -1015,9 +1040,17 @@ export function spawnExec(command) {
   const statusPath = join(dir, "status");
   // Newline-separated inside a group, so a command ending in a trailing
   // comment or redirection still has `echo` run as its own statement.
-  const script = `{\n${command}\necho $? > '${statusPath}'\n} 2>&1 | tee '${logPath}'\n`;
+  // Paths travel as data, never as shell source. A TMPDIR containing a quote,
+  // newline, dollar sign, or command substitution must not be able to break
+  // this wrapper or execute content merely because mkdtemp inherited it.
+  const script = `{\n${command}\necho $? > "$LISA_GATE_STATUS_PATH"\n} 2>&1 | tee "$LISA_GATE_LOG_PATH"\n`;
   try {
-    const child = boundedSpawnSync("sh", ["-c", script], {
+    const child = runProcessTree(script, {
+      env: {
+        ...process.env,
+        LISA_GATE_LOG_PATH: logPath,
+        LISA_GATE_STATUS_PATH: statusPath,
+      },
       stdio: "inherit",
       timeout: GATE_COMMAND_BUDGET_MS,
     });

package/all/copy-overwrite/scripts/lisa-schema-validate.mjs

@@ -150,9 +150,9 @@ function resolveRef(ref, root) {
   const defs = isSchemaObject(root.$defs) ? root.$defs : {};
   const target =
     match && Object.hasOwn(defs, match[1]) ? defs[match[1]] : undefined;
-  if (!target) {
+  if (!isSchemaObject(target)) {
     throw new Error(
-      `unsupported or unresolvable $ref "${ref}" (only #/$defs/<name> is supported)`
+      `unsupported or unresolvable $ref "${ref}" (only #/$defs/<name> resolving to a subschema object is supported)`
     );
   }
   return target;

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -536,7 +536,8 @@ function verifyLevel(config) {
     throw new TrackingError(
       `Unknown workItem.verify '${raw}'. Expected "trailer" (the default: ` +
         `prove the Work-Item reference, contact no tracker) or "full" (also ` +
-        `prove the tracker item's repo scope, claimed state, and PR backlink)`
+        `prove the tracker item exists and is open, has repo scope, is a leaf, ` +
+        `and carries the PR backlink)`
     );
   }
   return value;

package/cdk/package-lisa/package.lisa.json

@@ -8,7 +8,7 @@
       "prepare": "husky install || true",
       "test": "vitest run",
       "test:unit": "vitest run --exclude='**/integration/**'",
-      "test:integration:lisa": "vitest run '.integration.' 'integration/' --passWithNoTests",
+      "test:integration:lisa": "vitest run '.integration.' 'integration/'",
       "test:cov": "vitest run --coverage",
       "test:mutation": "node scripts/lisa-mutation.mjs",
       "test:watch": "vitest",

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAitBjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAonBjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA8tBjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAioBjC,CAAC"}