@codyswann/lisa 4.3.2 → 4.3.4

package/all/create-only/.github/workflows/continuous-gates.yml

@@ -71,4 +71,21 @@ jobs:
       moment: continuous:${{ inputs.environment || 'production' }}
       node_version: '22.21.1'
       package_manager: 'npm'
-    secrets: inherit
+  # No `secrets:` key, deliberately. `gates.yml` declares none in its
+  # `workflow_call` and contains zero occurrences of the string `secret`, so
+  # there is nothing here to pass and the correct mapping is the empty one —
+  # which in GitHub's grammar is the absence of the key, not `secrets: {}`.
+  #
+  # This shipped as `secrets: inherit`, which handed the callee every secret in
+  # the repository to read none of them. SonarCloud flags it as "Only pass
+  # required secrets to this workflow" and it degrades `new_security_rating`,
+  # which blocks the merge on any project whose Sonar analysis covers
+  # `.github/**`. `lisa-update-projects` already warns operators off `inherit`
+  # for exactly this reason; the template should not have been doing it.
+  #
+  # If `gates.yml` ever does need a secret, add the named mapping for that one
+  # secret. Do NOT reach for `inherit`, and do NOT try to fix a permissions
+  # error here instead: `permissions` in a reusable workflow is a CEILING the
+  # caller must already hold, and a caller granting less than the callee
+  # declares makes the run fail to LOAD — no jobs, no check, and a required
+  # context that never reports at all.

package/cdk/create-only/.github/workflows/deploy.yml

@@ -87,7 +87,8 @@ jobs:
       moment: pre-deploy:${{ needs.determine_environment.outputs.environment }}
       node_version: '22.21.1'
       package_manager: 'npm'
-    secrets: inherit
+    # No `secrets:` key: gates.yml declares none in its `workflow_call`, so
+    # passing any grants everything to a callee that reads nothing (#3065).
 
   release:
     name: 📦 Release
@@ -130,5 +131,6 @@ jobs:
       moment: post-deploy:${{ needs.determine_environment.outputs.environment }}
       node_version: '22.21.1'
       package_manager: 'npm'
-    secrets: inherit
+    # No `secrets:` key: gates.yml declares none in its `workflow_call`, so
+    # passing any grants everything to a callee that reads nothing (#3065).
 # Trigger staging deployment after CDK trust fix

package/dist/core/lisa-owned-templates.d.ts

@@ -65,4 +65,29 @@
  * @returns True when Lisa owns the file outright and may refresh it unprompted
  */
 export declare function isLisaOwnedTemplate(relativePath: string): boolean;
+/**
+ * Whether a template declares, in its own text, that Lisa replaces it wholesale
+ * on every run.
+ *
+ * This is the third population, and it exists because owned/not-owned is not a
+ * fine enough cut. `eslint.config.ts` is not Lisa-owned by
+ * {@link isLisaOwnedTemplate} — no `lisa-` segment, not under `scripts/` — and
+ * it is nonetheless replaced every run by design, with its header saying so and
+ * pointing at `eslint.config.local.ts` for customisation.
+ *
+ * Before this predicate existed that contract was honoured only by accident: a
+ * non-owned file fell through to the prompt branch, and under `--yes` the
+ * prompter said yes. The same fall-through discarded curated `knip.json` and
+ * `tsconfig.json` content, which is the defect. Separating the two populations
+ * by the declaration the template already carries fixes the second without
+ * freezing the first — freezing it would be #2374's undeliverable-fix incident
+ * returning through the door opened to fix this.
+ *
+ * Read from the PACKAGED source rather than the installed copy. The declaration
+ * is Lisa's statement about its own file, so a host cannot opt out by deleting
+ * the sentence; `.lisaignore` is the sanctioned way to hold your own version.
+ * @param templateContents - Contents of the packaged template file
+ * @returns True when the template declares it is replaced on every run
+ */
+export declare function declaresReplacedEveryRun(templateContents: string): boolean;
 //# sourceMappingURL=lisa-owned-templates.d.ts.map

package/dist/core/lisa-owned-templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-templates.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAQH;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAQjE"}
+{"version":3,"file":"lisa-owned-templates.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAQH;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAQjE;AAeD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAE1E"}

package/dist/core/lisa-owned-templates.js

@@ -75,4 +75,43 @@ export function isLisaOwnedTemplate(relativePath) {
             .split("/")
             .some(segment => segment.startsWith(LISA_NAMESPACE_PREFIX)));
 }
+/**
+ * The sentence a template uses to declare that Lisa replaces it on every run.
+ *
+ * Authored in the template itself, which is what makes it trustworthy: the file
+ * that says it is replaced is the file being replaced, so the declaration
+ * cannot drift away from the thing it describes the way an external roster can.
+ * 42 shipped templates carry it — `eslint.config.ts`, `vitest.config.ts`,
+ * `jest.config.ts`, `sgconfig.yml`, `lefthook.yml`, the ast-grep rule files —
+ * and each pairs it with the customisation surface a host is meant to use
+ * instead (`eslint.config.local.ts`, `*.thresholds.json`).
+ */
+const REPLACED_EVERY_RUN_MARKER = "IS replaced on each";
+/**
+ * Whether a template declares, in its own text, that Lisa replaces it wholesale
+ * on every run.
+ *
+ * This is the third population, and it exists because owned/not-owned is not a
+ * fine enough cut. `eslint.config.ts` is not Lisa-owned by
+ * {@link isLisaOwnedTemplate} — no `lisa-` segment, not under `scripts/` — and
+ * it is nonetheless replaced every run by design, with its header saying so and
+ * pointing at `eslint.config.local.ts` for customisation.
+ *
+ * Before this predicate existed that contract was honoured only by accident: a
+ * non-owned file fell through to the prompt branch, and under `--yes` the
+ * prompter said yes. The same fall-through discarded curated `knip.json` and
+ * `tsconfig.json` content, which is the defect. Separating the two populations
+ * by the declaration the template already carries fixes the second without
+ * freezing the first — freezing it would be #2374's undeliverable-fix incident
+ * returning through the door opened to fix this.
+ *
+ * Read from the PACKAGED source rather than the installed copy. The declaration
+ * is Lisa's statement about its own file, so a host cannot opt out by deleting
+ * the sentence; `.lisaignore` is the sanctioned way to hold your own version.
+ * @param templateContents - Contents of the packaged template file
+ * @returns True when the template declares it is replaced on every run
+ */
+export function declaresReplacedEveryRun(templateContents) {
+    return templateContents.includes(REPLACED_EVERY_RUN_MARKER);
+}
 //# sourceMappingURL=lisa-owned-templates.js.map

package/dist/core/lisa-owned-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-templates.js","sourceRoot":"","sources":["../../src/core/lisa-owned-templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,2EAA2E;AAC3E,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAEtC,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAEpC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,CACL,UAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACvC,UAAU;aACP,KAAK,CAAC,GAAG,CAAC;aACV,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"lisa-owned-templates.js","sourceRoot":"","sources":["../../src/core/lisa-owned-templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,2EAA2E;AAC3E,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAEtC,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAEpC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,CACL,UAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACvC,UAAU;aACP,KAAK,CAAC,GAAG,CAAC;aACV,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CAAC,gBAAwB;IAC/D,OAAO,gBAAgB,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;AAC9D,CAAC"}

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAs4EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA4iPjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAs4EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAgjPjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -33,7 +33,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/copy-overwrite/scripts/schemas/lisa-command-envelope.v1.schema.json": "d153b7c2953a30f180e38f09e98240c63327f5196eeba9bdf545e5a1f125a879",
     "all/copy-overwrite/scripts/schemas/lisa-state-contract.v1.schema.json": "6b7afe4ffeba8aaa53871d8855172f7eacde05953b1321145218ec638ff5c1c4",
     "all/create-only/.agents/rules/README.md": "fd260fd9b2934d0d698a8098dfff07fedc071849d588e602d773666678c3d540",
-    "all/create-only/.github/workflows/continuous-gates.yml": "d582465d1c73a63b511fe33427be9d50b7fa95598ce7f724a7496e7b441e3628",
+    "all/create-only/.github/workflows/continuous-gates.yml": "48c410a6547d4b7a5af332fec5f3c0be97ee9eb03418398a35d05c85e3354fbc",
     "all/create-only/.lisaignore": "735dc0a28a19e3aebc3d71b1ddf8b077e96ab17013d0f1c49d87c08558a315df",
     "all/create-only/scripts/remote-agent-aws-setup.sh": "bb0e67a52ea5badd0f291961c3a9fb25559f1f35e3042642d389a49eb47f7e31",
     "all/create-only/specs/.keep": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
@@ -54,7 +54,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "cdk/copy-overwrite/vitest.cdk.ts": "030158b11bec4f10b39585feb98f498981f307faa1fa314c7522e6def5d73c94",
     "cdk/copy-overwrite/vitest.config.ts": "c7f309d4f43d9188b9c067cb4900b2bdbacfbd28d135a6a2e6313cb0a37b030f",
     "cdk/create-only/.github/workflows/ci.yml": "98bd4b784a5a0a96bedc40c209f5bf5afe97fa422c200533d4544990a69a5c1a",
-    "cdk/create-only/.github/workflows/deploy.yml": "159ec01b717737b7d0004cc54f526a36ce67406a249c5dbf2a449b914eb0bfbc",
+    "cdk/create-only/.github/workflows/deploy.yml": "f32ec7eecc7451812213fc66f1a6fa4b360137c586d47ede06747f04eb557251",
     "cdk/create-only/cdk.json": "f89030d8fe145a1dbabd59d89ddee4e16984f222d737f7fcf6b778d911e9fe40",
     "cdk/create-only/tsconfig.local.json": "d26253827e21fd7c41d30565fe3d339675f119e00bb24c5713a01f57ccd06602",
     "cdk/create-only/vitest.config.local.ts": "a70a6d2a4f210304cf84b8017b2c628c0ef689712c4f745ef45e1fcfffac4050",
@@ -121,7 +121,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "expo/copy-overwrite/tsconfig.json": "c92e2c2c109e8794ee351f634361ef46297f5a0cd606aaf5c19911da836df307",
     "expo/create-only/.github/required-checks.json": "11c77cb42306efaa71d1be14ab0c77651bd52b0f010820f63a43daab467ccb12",
     "expo/create-only/.github/workflows/ci.yml": "5ea18b202fd952a79996e310fd933a2ac741d5e639b4d15224276e7e285f91ba",
-    "expo/create-only/.github/workflows/deploy.yml": "b2e9805f4e6d0d892c92417d2ec994027efd7dcd19a3f61e3782c5d080a5b70f",
+    "expo/create-only/.github/workflows/deploy.yml": "fdc5f57a3f2c9681e9fb1345ef2a3821aebf6ef3ecedc35faed32ea8384ab1dc",
     "expo/create-only/.github/workflows/maestro-e2e.yml": "cd587cd38ca985b621d572e96f05425bcb9ca8dcef9af5b338349cfa1e6cfd39",
     "expo/create-only/.github/workflows/nightly-e2e-bypass-reaper.yml": "db78a1012a00cf4e8b023a67bb57566ae85cf790c3856f3e299636c766f0c242",
     "expo/create-only/.github/workflows/nightly-e2e-health.yml": "b44de3f07bdc63019e7e63cf524abe7b72f9791454b7514ab2f660a95aa28e93",
@@ -162,7 +162,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "harper-fabric/copy-overwrite/tsconfig.eslint.json": "63ddc31cbbdf91ba4def5f04ed76b2a8b61ced456d4472aea77a55cc037a62e1",
     "harper-fabric/copy-overwrite/tsconfig.json": "64b9f2e919160568712e2641b125aa21bec486532249a7b17e4fb2f4bb3988cc",
     "harper-fabric/copy-overwrite/vitest.config.ts": "94ee60be0e9a4b735cf1b053143751c9968465ff04fb59fbdfc252e7413ff337",
-    "harper-fabric/create-only/.github/workflows/deploy.yml": "698419ba902d5ec69679313cd3394b0ca9af98b9e7d9732ac893055295120dbc",
+    "harper-fabric/create-only/.github/workflows/deploy.yml": "dd7455fe0f6ebd77b2b2e6ed0846843973536d2da57b0ed67b6bbcb62af32224",
     "harper-fabric/create-only/.github/workflows/zap-baseline.yml": "925ee1068e53d46fd0374299c1ee73d0b791e201169772cd509946ef503de8f5",
     "harper-fabric/create-only/.zap/baseline.conf": "68aae4b1b9b5b7253b5aeb792d72b58f64e5eda1dcf8f3062bd9d77494a5a22f",
     "harper-fabric/create-only/scripts/zap-baseline.sh": "00f5a2bdf6c9ecf0d7a1c74ec629364b09bab1f79c4ea71779826288702d76aa",
@@ -204,7 +204,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "nestjs/create-only/.github/k6/thresholds/strict.json": "e121ec72de4596b95c013a8c71f03653bcdf057cf7f8d1fec6f0e13c1381867f",
     "nestjs/create-only/.github/required-checks.json": "620455acdebb95136f9061db0c5e431f3396974b2f8208250ee22dc39098e1bd",
     "nestjs/create-only/.github/workflows/ci.yml": "aba5d0d7b7eafcd0ceb4d6c6a9fa205d5473fed937cfc86012559bcb11258f9b",
-    "nestjs/create-only/.github/workflows/deploy.yml": "86f71854c84eb2ccf62bbf739c1acc4407fc6841cb11daa938afa542d39e6d0a",
+    "nestjs/create-only/.github/workflows/deploy.yml": "d7198bc080a05775e669e0f04e9221447b81d19fc84b4e2812596dd9ec501c83",
     "nestjs/create-only/.zap/baseline.conf": "a7cd559b014555ef2efe7a6ce129384ec376ce4d66d5bc3ae9e2f3f883172c4d",
     "nestjs/create-only/scripts/zap-baseline.sh": "9d81fdb3419753ca4ec5509e37365543d7608c7a9924635ef1acb4734cb3bbd1",
     "nestjs/create-only/tsconfig.local.json": "0b720ddad0d18f52dadf33bdc4a0aec0eb65c506bc8ebb692f880bdf31d1011d",
@@ -1054,7 +1054,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "rails/copy-overwrite/scripts/threshold-ratchet-families.mjs": "f50e35d11295a836bd5b6d818aed6daea68ff70bdffbbdf9f67b09984a2628da",
     "rails/copy-overwrite/sgconfig.yml": "ff5b62de42eb969a851fdc53ee6932a32ffe010b567ed2c62460ed454ad2a24f",
     "rails/create-only/.github/workflows/ci.yml": "924375bcfcb8c13f546a7e323cf5ad99cee1427d3ba90386680db16b981e5ab4",
-    "rails/create-only/.github/workflows/deploy.yml": "3290e124a2ef7c74294a573bd3b23b57a1a62655e0820ab6040cc7044de628d6",
+    "rails/create-only/.github/workflows/deploy.yml": "11dc8b52947f6b1476a277d1fe5f532b398ae9cd4b8d0dc8cc09df3e4e4f77eb",
     "rails/create-only/.mise.toml": "28be5746256a30ad2260da7d37244cc461f8963ce5d5a81ddce71b48f0ab6ef0",
     "rails/create-only/.mutant.yml": "9ee28ad14e4688e58827510eb9b7197d9a368fc670821145a08f7542e2e216d8",
     "rails/create-only/.reek.yml": "d2fca1f6367719b002ea51c76e10cb9e08b1c34991b4386696f79a1a36c6a385",
@@ -7910,6 +7910,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/config/coderabbit-labeling-scope.test.ts": true,
     "tests/unit/config/conflict-prover-consumer-layouts.test.ts": true,
     "tests/unit/config/coverage-unit-script-runner-parity.test.ts": true,
+    "tests/unit/config/create-only-caller-secrets.test.ts": true,
     "tests/unit/config/declared-gate-executors.test.ts": true,
     "tests/unit/config/dependabot-not-distributed.test.ts": true,
     "tests/unit/config/dist-rebuild-window.test.ts": true,
@@ -8009,6 +8010,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/core/learnings-writer.test.ts": true,
     "tests/unit/core/lisa-owned-enforcement-scripts.test.ts": true,
     "tests/unit/core/lisa-owned-provenance.test.ts": true,
+    "tests/unit/core/lisa-owned-templates-classification.test.ts": true,
     "tests/unit/core/lisa-owned-templates.test.ts": true,
     "tests/unit/core/lisa-plugin-selection.test.ts": true,
     "tests/unit/core/lisa-skill-sources.test.ts": true,
@@ -8021,6 +8023,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/core/self-apply.test.ts": true,
     "tests/unit/core/skill-frontmatter-contract.test.ts": true,
     "tests/unit/core/sonar-integration.test.ts": true,
+    "tests/unit/core/update-skill-apply-mode.test.ts": true,
     "tests/unit/core/upstream-attribution-body-hardening.test.ts": true,
     "tests/unit/core/upstream-attribution-body.test.ts": true,
     "tests/unit/core/upstream-attribution-file-safety.test.ts": true,
@@ -8410,6 +8413,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/strategies/copy-overwrite-prompted-downgrade.test.ts": true,
     "tests/unit/strategies/copy-overwrite-refresh-templates.test.ts": true,
     "tests/unit/strategies/copy-overwrite-unattended-consent.test.ts": true,
+    "tests/unit/strategies/copy-overwrite-yes-preserves-curated.test.ts": true,
     "tests/unit/strategies/copy-overwrite.test.ts": true,
     "tests/unit/strategies/create-only.test.ts": true,
     "tests/unit/strategies/credential-substrate-precedence.test.ts": true,