@codyswann/lisa 4.34.14 → 4.34.16

package/all/copy-overwrite/scripts/check-npm-publish-landed.mjs

@@ -0,0 +1,250 @@
+#!/usr/bin/env node
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/**
+ * Prove a version reached the npm registry, rather than trusting the exit code
+ * of the command that was supposed to put it there.
+ *
+ * Measured incident (CodySwannGT/lisa#3684): `v4.33.7` was tagged, a GitHub
+ * Release was cut for it, and a provenance statement was written to the sigstore
+ * transparency log — and `registry.npmjs.org/@codyswann/lisa/4.33.7` returned
+ * 404, and still did a day later. Three artifacts asserted the release had
+ * happened; the registry, the only one a consumer can install from, disagreed.
+ * Nothing retried it and nothing flagged it: the version counter moved on to
+ * 4.33.8, which makes the hole invisible in every downstream view.
+ *
+ * The publish itself had failed with `E401 Unauthorized` from npm's OIDC
+ * trusted-publisher exchange. There is no long-lived token in that path to
+ * rotate — the credential is minted per run — and the next release published
+ * fine 17 minutes later through the identical code path. So the failure is
+ * INTERMITTENT, and that is exactly why it needs a check: a permanently broken
+ * credential announces itself on the next release, while one that fails once in
+ * N produces a permanently skipped version with no signal at all.
+ *
+ * ## The exact-version endpoint, never `dist-tags.latest`
+ *
+ * `<registry>/<name>/<version>` answers about the version in hand.
+ * `<registry>/<name>` → `dist-tags.latest` answers about whichever version the
+ * registry currently considers newest, and it lags a successful publish by
+ * several minutes (CodySwannGT/lisa#3685). Verifying against `latest` would
+ * report a false 404 for a publish that actually landed, which trains everyone
+ * to ignore the check — the failure mode that ends with the check deleted.
+ *
+ * ## Three verdicts, because two would hide one of them
+ *
+ * - `published` — the registry served this exact version. Exit 0.
+ * - `missing` — the registry answered, and said 404. Exit 1.
+ * - `unprovable` — the registry could not be asked: transport error, 5xx, or a
+ *   200 whose body names a different version. Exit 1.
+ *
+ * `unprovable` blocks. It is not a pass, because nothing was proved, and a
+ * check that returns success for an input it never examined is the defect this
+ * script exists to catch, one layer up. It is not `missing` either: drafting a
+ * GitHub Release or alarming a human on a registry blip would be a false
+ * accusation, so the caller gets to tell the two apart and act differently.
+ * That distinction is the whole reason the verdict is a word on stdout and not
+ * just an exit code.
+ * @module scripts/check-npm-publish-landed
+ */
+import process from "node:process";
+
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
+
+/** Public npm registry, the default for every Lisa release. */
+const DEFAULT_REGISTRY = "https://registry.npmjs.org";
+
+/** How many times to ask before settling on an answer. */
+const DEFAULT_ATTEMPTS = 5;
+
+/** Pause between attempts, in milliseconds. */
+const DEFAULT_DELAY_MS = 3000;
+
+/** The line a caller greps for. Never printed without a real verdict behind it. */
+const VERDICT_PREFIX = "npm-publish-landed:";
+
+/**
+ * The URL that answers "is this exact version on the registry".
+ *
+ * Deliberately the only URL this module ever builds. A packument read
+ * (`<registry>/<name>`) would carry `dist-tags`, and having that object in hand
+ * is all it takes for someone to start consulting it — so the shape that could
+ * regress is simply never fetched.
+ * @param {string} registry - Registry origin, no trailing slash.
+ * @param {string} name - Package name, scope included.
+ * @param {string} version - Exact version, no range syntax.
+ * @returns {string} The exact-version manifest URL.
+ */
+export function exactVersionUrl(registry, name, version) {
+  // Trailing slashes trimmed without a regex: `/\/+$/` is a super-linear
+  // pattern the shipped ruleset rejects outright, and an origin arriving from
+  // configuration is exactly the kind of attacker-adjacent input that rule
+  // exists for.
+  let origin = registry;
+  while (origin.endsWith("/")) origin = origin.slice(0, -1);
+  return `${origin}/${name}/${version}`;
+}
+
+/**
+ * Ask the registry once.
+ * @param {string} url - The exact-version manifest URL.
+ * @param {typeof fetch} fetchImpl - Injected for tests.
+ * @param {string} version - The version the answer must name.
+ * @returns {Promise<{verdict: string, detail: string}>} One attempt's outcome.
+ */
+async function askOnce(url, fetchImpl, version) {
+  let response;
+  try {
+    response = await fetchImpl(url, {
+      headers: { accept: "application/json" },
+    });
+  } catch (error) {
+    return { verdict: "unprovable", detail: `network: ${error.message}` };
+  }
+  if (response.status === 404) {
+    return { verdict: "missing", detail: "registry returned 404" };
+  }
+  if (!response.ok) {
+    return { verdict: "unprovable", detail: `HTTP ${response.status}` };
+  }
+  let manifest;
+  try {
+    manifest = await response.json();
+  } catch (error) {
+    return {
+      verdict: "unprovable",
+      detail: `unparseable body: ${error.message}`,
+    };
+  }
+  // A 200 that names a different version is not this version being present. The
+  // registry is not expected to do this; treating it as proof anyway is how a
+  // surprise becomes a silent pass.
+  if (manifest?.version !== version) {
+    return {
+      verdict: "unprovable",
+      detail: `HTTP 200 but the body names version ${String(manifest?.version)}`,
+    };
+  }
+  return { verdict: "published", detail: "registry served this exact version" };
+}
+
+/**
+ * Whether an attempt's verdict is worth another try.
+ *
+ * Both non-published verdicts are retried, for different reasons. `missing` is
+ * retried because a publish that just succeeded may not have propagated yet;
+ * `unprovable` because a 5xx or a dropped connection says nothing about the
+ * package. Neither is allowed to become `published` — a retry can only confirm
+ * or replace a non-answer, never upgrade one.
+ * @param {string} verdict - The attempt's verdict.
+ * @returns {boolean} Whether to ask again.
+ */
+const worthRetrying = verdict => verdict !== "published";
+
+/**
+ * Prove, or fail to prove, that one version is on the registry.
+ * @param {object} options - Everything the check needs.
+ * @param {string} options.packageName - Package name, scope included.
+ * @param {string} options.version - Exact version to look for.
+ * @param {string} [options.registry] - Registry origin.
+ * @param {number} [options.attempts] - How many times to ask.
+ * @param {number} [options.delayMs] - Pause between attempts.
+ * @param {typeof fetch} [options.fetchImpl] - Injected for tests.
+ * @param {(ms: number) => Promise<void>} [options.sleep] - Injected for tests.
+ * @returns {Promise<{verdict: string, detail: string, urls: string[]}>} Outcome.
+ */
+export async function verifyPublish({
+  packageName,
+  version,
+  registry = DEFAULT_REGISTRY,
+  attempts = DEFAULT_ATTEMPTS,
+  delayMs = DEFAULT_DELAY_MS,
+  fetchImpl = fetch,
+  sleep = ms => new Promise(resolve => setTimeout(resolve, ms)),
+}) {
+  const url = exactVersionUrl(registry, packageName, version);
+  const urls = [];
+  let outcome = { verdict: "unprovable", detail: "no attempt was made" };
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    urls.push(url);
+    outcome = await askOnce(url, fetchImpl, version);
+    if (!worthRetrying(outcome.verdict)) break;
+    if (attempt < attempts) await sleep(delayMs);
+  }
+  return { ...outcome, urls };
+}
+
+/** Return a required CLI option, or exit naming it. */
+function requiredOption(argv, name) {
+  const index = argv.indexOf(name);
+  const value = index === -1 ? undefined : argv[index + 1];
+  if (value === undefined || value.startsWith("--")) {
+    throw new Error(`Missing required option ${name}`);
+  }
+  return value;
+}
+
+/** Return an optional CLI option. */
+function option(argv, name, fallback) {
+  const index = argv.indexOf(name);
+  const value = index === -1 ? undefined : argv[index + 1];
+  return value === undefined || value.startsWith("--") ? fallback : value;
+}
+
+/**
+ * Run the check and report, for a caller that is a workflow step.
+ * @param {string[]} argv - Arguments after the script path.
+ * @param {object} [injected] - Test seams forwarded to {@link verifyPublish}.
+ * @returns {Promise<number>} Process exit code.
+ */
+export async function main(argv, injected = {}) {
+  const packageName = requiredOption(argv, "--package");
+  const version = requiredOption(argv, "--version");
+  const registry = option(argv, "--registry", DEFAULT_REGISTRY);
+  const attempts = Number(option(argv, "--attempts", String(DEFAULT_ATTEMPTS)));
+  const delayMs = Number(option(argv, "--delay-ms", String(DEFAULT_DELAY_MS)));
+
+  const { verdict, detail, urls } = await verifyPublish({
+    packageName,
+    version,
+    registry,
+    attempts,
+    delayMs,
+    ...injected,
+  });
+
+  process.stdout.write(
+    `${VERDICT_PREFIX} ${verdict} package=${packageName} version=${version}\n`
+  );
+  if (verdict === "published") {
+    process.stdout.write(`✅ ${packageName}@${version} is on ${registry}.\n`);
+    return 0;
+  }
+  const asked = urls[0] ?? exactVersionUrl(registry, packageName, version);
+  process.stderr.write(
+    verdict === "missing"
+      ? `❌ ${packageName}@${version} is NOT on the registry.\n` +
+          `   ${asked} → 404 after ${urls.length} attempt(s).\n` +
+          `   A tag, a GitHub Release and a provenance statement can all exist\n` +
+          `   for a version consumers cannot install. This is that state.\n`
+      : `❌ Could not prove ${packageName}@${version} reached the registry.\n` +
+          `   ${asked} → ${detail} (after ${urls.length} attempt(s)).\n` +
+          `   This is NOT a clean result and NOT a confirmed miss — nothing was\n` +
+          `   proved either way, so it blocks rather than reporting a verdict it\n` +
+          `   does not have.\n`
+  );
+  return 1;
+}
+
+/* c8 ignore start -- CLI wiring, exercised through main() in tests */
+if (invokedAsScript(import.meta.url)) {
+  main(process.argv.slice(2))
+    .then(code => {
+      process.exitCode = code;
+    })
+    .catch(error => {
+      process.stderr.write(`❌ ${error.message}\n`);
+      process.exitCode = 1;
+    });
+}
+/* c8 ignore stop */

package/all/copy-overwrite/scripts/lib/gate-failure-diagnosis.mjs

@@ -486,12 +486,10 @@ function killedVerdict(code, load) {
  * way this whole module can do harm.
  */
 const RESOURCE_REFUSAL_PATTERNS = Object.freeze([
-  /\bsetpgid\s*\([^)]*\):\s*Operation not permitted/,
+  /\bchild setpgid\s*\(\d+\s+to\s+\d+\):\s*Operation not permitted/,
   /\bfork:\s*Resource temporarily unavailable/,
-  /\bposix_spawn\b[^\n]*\b(?:EAGAIN|ENOMEM)\b/,
-  /\bspawn\b[^\n]*\bEAGAIN\b/,
-  /\bEMFILE\b|\bToo many open files\b/,
-  /\bENOMEM\b|\bCannot allocate memory\b/,
+  /\bposix_spawn\b[^\n]*\b(?:EAGAIN|ENOMEM|EMFILE)\b/,
+  /\bspawn\b[^\n]*\b(?:EAGAIN|ENOMEM|EMFILE)\b/,
 ]);
 
 /**

package/all/copy-overwrite/scripts/lisa-hooks/block-direct-issue-create.sh

@@ -1435,8 +1435,20 @@ EXEC_WRAPPERS = {
 }
 
 # Interpreter options that mean "no script file follows": a command string or a
-# module name, both of which the guard reads by other means or not at all.
-NO_SCRIPT_OPTIONS = {"-c", "-e", "-m", "--eval", "--command", "--module"}
+# module name, both of which the guard reads by other means or not at all. These
+# are interpreter-specific on purpose. `bash -e create.sh` and `sh -m create.sh`
+# still execute the following file; treating Python and Node flags as universal
+# silently stopped the scan before those shell operands.
+NO_SCRIPT_OPTIONS = {
+    "bun": {"-e", "--eval"},
+    "node": {"-e", "--eval"},
+    "nodejs": {"-e", "--eval"},
+    "perl": {"-e"},
+    "php": {"-r"},
+    "python": {"-c", "-m", "--command", "--module"},
+    "python3": {"-c", "-m", "--command", "--module"},
+    "ruby": {"-e"},
+}
 
 # Programs that READ their operands and never execute them as programs.
 #
@@ -1572,7 +1584,12 @@ def executed_operand(argv):
         if argument.startswith("-"):
             # A command string or a module name; no script file follows.
             head = argument.split("=", 1)[0]
-            if argument in NO_SCRIPT_OPTIONS or head in NO_SCRIPT_OPTIONS:
+            if program in {"bash", "dash", "ksh", "sh", "zsh"}:
+                # Shell `-c` may be clustered (`-ec`), while `-e` and `-m` are
+                # ordinary shell options and do not consume the script path.
+                if not head.startswith("--") and "c" in head[1:]:
+                    return None
+            elif head in NO_SCRIPT_OPTIONS.get(program, set()):
                 return None
             continue
         return argument

package/all/copy-overwrite/scripts/lisa-hooks/block-managed-file-edits.sh

@@ -93,7 +93,7 @@
 # from mine", and guessing "behind" is how a fork's stronger guard gets silently
 # replaced by a weaker upstream one. Add a name here in the same commit that
 # closes a vector.
-# lisa-guard-capabilities: managed-path-resolution, lisaignore-precedence, generated-path-rebuild, redirect-target, tee-target, sed-in-place-all-spellings, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand
+# lisa-guard-capabilities: managed-path-resolution, lisaignore-precedence, generated-path-rebuild, redirect-target, tee-target, sed-in-place-all-spellings, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand, direct-script-command-reach, analyzer-failure-visible
 set -euo pipefail
 
 input="$(cat)"
@@ -610,7 +610,9 @@ def command_word(statement):
         statement: One statement's tokens.
 
     Returns:
-        A pair (program, args); (None, []) when no program is named.
+        A triple (token, program, args); (None, None, []) when no program is
+        named. The raw token is retained because `./edit.sh` has no interpreter:
+        its command word is itself the executed script.
     """
     index = 0
     while index < len(statement):
@@ -620,7 +622,7 @@ def command_word(statement):
             continue
         program = token.rsplit("/", 1)[-1]
         if program not in FOLLOW_WRAPPERS:
-            return (program, statement[index + 1 :])
+            return (token, program, statement[index + 1 :])
         separate, positional = FOLLOW_WRAPPERS[program]
         index += 1
         while index < len(statement) and statement[index].startswith("-"):
@@ -630,7 +632,7 @@ def command_word(statement):
                 break
             index += 2 if option in separate else 1
         index += positional
-    return (None, [])
+    return (None, None, [])
 
 
 def shell_script_operand(args):
@@ -677,7 +679,7 @@ def write_targets(statement):
         Candidate paths this statement writes.
     """
     found = []
-    program, args = command_word(statement)
+    _token, program, args = command_word(statement)
     for index, token in enumerate(statement):
         if token in REDIRECT_OUT and index + 1 < len(statement):
             found.append(statement[index + 1])
@@ -700,7 +702,7 @@ def executed_script(statement):
     Returns:
         The operand token naming a script that will run, or None.
     """
-    program, args = command_word(statement)
+    token, program, args = command_word(statement)
     if program is None:
         return None
     if program in SHELL_PROGRAMS:
@@ -711,6 +713,12 @@ def executed_script(statement):
         return shell_script_operand(args)
     if program in SOURCE_BUILTINS:
         return args[0] if args else None
+    # A script in command position executes through its shebang. This also
+    # covers a direct path after wrappers such as `sudo ./edit.sh`; `command_word`
+    # deliberately keeps the raw token while using its basename for wrapper and
+    # shell classification.
+    if resolve(token) is not None:
+        return token
     return None
 
 
@@ -801,10 +809,27 @@ for target in targets:
     if cleaned:
         print(cleaned)
 PY
-    write_targets="$(printf '%s' "$analyzer" |
+    analyzer_stderr="$(mktemp "${TMPDIR:-/tmp}/lisa-managed-edit-analyzer.XXXXXX")" || {
+      printf 'block-managed-file-edits: could not allocate analyzer stderr capture; Bash write protection is NOT active\n' >&2
+      exit 0
+    }
+    if write_targets="$(printf '%s' "$analyzer" |
       MANAGED_EDIT_COMMAND="$command_str" \
         MANAGED_EDIT_PROJECT="$project_root" \
-        python3 - 2>/dev/null || true)"
+        python3 - 2>"$analyzer_stderr")"; then
+      analyzer_status=0
+    else
+      analyzer_status=$?
+    fi
+    if [ "$analyzer_status" -ne 0 ]; then
+      printf 'block-managed-file-edits: Bash analyzer failed (exit %s); Bash write protection is NOT active\n' "$analyzer_status" >&2
+      while IFS= read -r analyzer_line; do
+        [ -n "$analyzer_line" ] && printf '  python3: %s\n' "$analyzer_line" >&2
+      done <"$analyzer_stderr"
+      rm -f "$analyzer_stderr"
+      exit 0
+    fi
+    rm -f "$analyzer_stderr"
     while IFS= read -r token; do
       [ -n "$token" ] || continue
       if source_path="$(managed_source "$token")"; then

package/all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh

@@ -36,7 +36,7 @@
 # Add a name here in the same commit that closes a vector. A hardening that
 # forgets to is invisible to refresh, and shows up as an unexplained diff at
 # review time instead of a named capability.
-# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, env-split-string, git-config-key, git-config-parameters, git-config-parameters-append, git-config-parameters-expansion, heredoc-shell-word, herestring-aware, no-verify-short, nested-shell-no-verify, nested-shell-long-options, env-split-string-abbrev, command-wrapper-normalization, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand, dispatcher-exec-position
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, env-split-string, git-config-key, git-config-parameters, git-config-parameters-append, git-config-parameters-expansion, heredoc-shell-word, herestring-aware, no-verify-short, nested-shell-no-verify, nested-shell-long-options, env-split-string-abbrev, command-wrapper-normalization, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand, dispatcher-exec-position, tilde-script-reach, shell-option-stdin-reach
 #
 # Shell-token matching avoids false positives from issue bodies, heredocs, and
 # commit-message prose while still catching quoted real argv values such as
@@ -268,8 +268,38 @@ ENV_LONG_SEPARATE_VALUE = {"--argv0", "--chdir", "--split-string", "--unset"}
 
 # env's single-letter options, by whether the rest of a cluster is more
 # options or the option's value.
+#
+# BOTH PLATFORMS' SETS, not one. These began as GNU's, and an option that is
+# in neither set falls through to `ambiguous`, which this guard treats as
+# suspicious. That default is correct and stays — an unknown option genuinely
+# could take a value and swallow the command name. What is wrong is a
+# well-known option being unknown, and on a macOS fleet `env -P` is exactly
+# that: BSD's "search altpath for the utility", refused on every ordinary
+# command it prefixes.
+#
+# Measured, one option at a time, against the guard before this change. BSD's
+# complete short set is `0 i v u C P S`, from the synopsis in env(1):
+#
+#     allowed   -0  -i  -v  -u NAME  -C DIR     already covered
+#     BLOCKED   -P altpath                      the defect, and the ONLY one
+#     BLOCKED   -S string                       correct: split-string reparses
+#                                               an opaque payload, so what it
+#                                               runs cannot be proven here
+#     BLOCKED   -Z  -Q                          correct: unknown stays suspicious
+#
+# So the population is one letter, not a class. The two platforms' short
+# options coincide everywhere else, which is why "detect the platform and
+# choose a table" would be machinery for a single character — and would fail
+# on a machine running GNU coreutils under a BSD userland, or the reverse.
+# Recognising the union is both smaller and more robust.
+#
+# Adding a letter here is a WEAKENING, so it needs the same evidence as any
+# other: ten bypass shapes routed through `-P` — long flag, attached value,
+# short cluster, abbreviation, an assignment, `HUSKY=0`, a hooksPath disable,
+# a nested `-c` shell, an executed script, and `-P` swallowing the command
+# word — were all refused before this change and are all still refused after.
 ENV_SHORT_NO_VALUE = frozenset("i0v")
-ENV_SHORT_TAKES_VALUE = frozenset("uCaS")
+ENV_SHORT_TAKES_VALUE = frozenset("uCaSP")
 
 # Builtins and wrappers that run whatever FOLLOWS them without changing what
 # it is: `command env -S ...` runs exactly the `env` that `env -S ...` runs,
@@ -980,7 +1010,7 @@ def resolve_script(token):
     """
     if COMPUTED_VALUE.search(token):
         return (None, "a computed path the guard cannot resolve before the shell does")
-    text = token.strip().strip("'\"")
+    text = os.path.expanduser(token.strip().strip("'\""))
     # `bash -` and a bare `-` read the script from stdin; there is no file.
     if not text or text == "-":
         return (None, None)
@@ -1002,6 +1032,48 @@ def resolve_script(token):
     return (None, "a script that does not exist or cannot be read")
 
 
+SHELL_COMMAND_STRING = object()
+SHELL_STDIN = object()
+
+
+def shell_execution_operand(args):
+    """The file a shell runs, or a sentinel for `-c` and stdin modes.
+
+    `shell_script_operand` intentionally collapses both cases to None for the
+    nested-command scanner. Reach cannot: `bash -c '...'` has already exposed
+    its text, while `bash -x`, `bash -e`, and `bash --` still await a script on
+    stdin and must remain linked to a following `< file` separator.
+    """
+    index = 0
+    opaque_option_seen = False
+    while index < len(args):
+        token = args[index]
+        if token == "--":
+            index += 1
+            break
+        if not token.startswith(("-", "+")):
+            if not opaque_option_seen:
+                break
+            index += 1
+            opaque_option_seen = False
+            continue
+        if token in SHELL_OPTIONS_SEPARATE_VALUE:
+            index += 2
+            continue
+        if token.startswith(SHELL_OPTIONS_INLINE_VALUE):
+            index += 1
+            continue
+        if token.startswith("--"):
+            if token not in SHELL_LONG_OPTIONS_NO_VALUE:
+                opaque_option_seen = True
+            index += 1
+            continue
+        if "c" in token[1:]:
+            return SHELL_COMMAND_STRING
+        index += 1
+    return args[index] if index < len(args) else SHELL_STDIN
+
+
 def executed_scripts(tokens):
     """The files a command line will RUN, and the executions it cannot follow.
 
@@ -1036,9 +1108,12 @@ def executed_scripts(tokens):
             if name in SOURCE_BUILTINS:
                 operand = arguments[0] if arguments else None
             elif name in SHELL_PROGRAMS:
-                operand = shell_script_operand(arguments)
-                if operand is None and not arguments:
+                operand = shell_execution_operand(arguments)
+                if operand is SHELL_STDIN:
                     previous_shell_awaiting_stdin = True
+                    continue
+                if operand is SHELL_COMMAND_STRING:
+                    continue
             else:
                 continue
             if operand is None:

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -3475,7 +3475,7 @@ function recordDeployRole(ref, before, role) {
  * that wrongly did.
  * @param {string} ref Canonical work-item reference.
  * @param {object} contract The resolved tracker contract.
- * @returns {{applied: boolean, merged: number[], report: string, terminal: string|null}}
+ * @returns {{applied: boolean, bases: string, merged: number[], report: string, terminal: string|null}}
  *   What was applied, and why.
  */
 function completeGithubWorkItem(ref, contract) {

package/dist/codex/scripts/block-no-verify.sh

@@ -10,7 +10,7 @@
 # `git -c "core.hooksPath=/dev/null"`.
 #
 # Capability names below are the canonical guard's, kept identical on every agent.
-# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, env-split-string, git-config-key, git-config-parameters, git-config-parameters-append, git-config-parameters-expansion, heredoc-shell-word, herestring-aware, no-verify-short, nested-shell-no-verify, nested-shell-long-options, env-split-string-abbrev, command-wrapper-normalization, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand, dispatcher-exec-position
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, env-split-string, git-config-key, git-config-parameters, git-config-parameters-append, git-config-parameters-expansion, heredoc-shell-word, herestring-aware, no-verify-short, nested-shell-no-verify, nested-shell-long-options, env-split-string-abbrev, command-wrapper-normalization, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand, dispatcher-exec-position, tilde-script-reach, shell-option-stdin-reach
 set -euo pipefail
 
 input="$(cat 2>/dev/null || true)"
@@ -171,8 +171,38 @@ ENV_LONG_SEPARATE_VALUE = {"--argv0", "--chdir", "--split-string", "--unset"}
 
 # env's single-letter options, by whether the rest of a cluster is more
 # options or the option's value.
+#
+# BOTH PLATFORMS' SETS, not one. These began as GNU's, and an option that is
+# in neither set falls through to `ambiguous`, which this guard treats as
+# suspicious. That default is correct and stays — an unknown option genuinely
+# could take a value and swallow the command name. What is wrong is a
+# well-known option being unknown, and on a macOS fleet `env -P` is exactly
+# that: BSD's "search altpath for the utility", refused on every ordinary
+# command it prefixes.
+#
+# Measured, one option at a time, against the guard before this change. BSD's
+# complete short set is `0 i v u C P S`, from the synopsis in env(1):
+#
+#     allowed   -0  -i  -v  -u NAME  -C DIR     already covered
+#     BLOCKED   -P altpath                      the defect, and the ONLY one
+#     BLOCKED   -S string                       correct: split-string reparses
+#                                               an opaque payload, so what it
+#                                               runs cannot be proven here
+#     BLOCKED   -Z  -Q                          correct: unknown stays suspicious
+#
+# So the population is one letter, not a class. The two platforms' short
+# options coincide everywhere else, which is why "detect the platform and
+# choose a table" would be machinery for a single character — and would fail
+# on a machine running GNU coreutils under a BSD userland, or the reverse.
+# Recognising the union is both smaller and more robust.
+#
+# Adding a letter here is a WEAKENING, so it needs the same evidence as any
+# other: ten bypass shapes routed through `-P` — long flag, attached value,
+# short cluster, abbreviation, an assignment, `HUSKY=0`, a hooksPath disable,
+# a nested `-c` shell, an executed script, and `-P` swallowing the command
+# word — were all refused before this change and are all still refused after.
 ENV_SHORT_NO_VALUE = frozenset("i0v")
-ENV_SHORT_TAKES_VALUE = frozenset("uCaS")
+ENV_SHORT_TAKES_VALUE = frozenset("uCaSP")
 
 # Builtins and wrappers that run whatever FOLLOWS them without changing what
 # it is: `command env -S ...` runs exactly the `env` that `env -S ...` runs,
@@ -883,7 +913,7 @@ def resolve_script(token):
     """
     if COMPUTED_VALUE.search(token):
         return (None, "a computed path the guard cannot resolve before the shell does")
-    text = token.strip().strip("'\"")
+    text = os.path.expanduser(token.strip().strip("'\""))
     # `bash -` and a bare `-` read the script from stdin; there is no file.
     if not text or text == "-":
         return (None, None)
@@ -905,6 +935,48 @@ def resolve_script(token):
     return (None, "a script that does not exist or cannot be read")
 
 
+SHELL_COMMAND_STRING = object()
+SHELL_STDIN = object()
+
+
+def shell_execution_operand(args):
+    """The file a shell runs, or a sentinel for `-c` and stdin modes.
+
+    `shell_script_operand` intentionally collapses both cases to None for the
+    nested-command scanner. Reach cannot: `bash -c '...'` has already exposed
+    its text, while `bash -x`, `bash -e`, and `bash --` still await a script on
+    stdin and must remain linked to a following `< file` separator.
+    """
+    index = 0
+    opaque_option_seen = False
+    while index < len(args):
+        token = args[index]
+        if token == "--":
+            index += 1
+            break
+        if not token.startswith(("-", "+")):
+            if not opaque_option_seen:
+                break
+            index += 1
+            opaque_option_seen = False
+            continue
+        if token in SHELL_OPTIONS_SEPARATE_VALUE:
+            index += 2
+            continue
+        if token.startswith(SHELL_OPTIONS_INLINE_VALUE):
+            index += 1
+            continue
+        if token.startswith("--"):
+            if token not in SHELL_LONG_OPTIONS_NO_VALUE:
+                opaque_option_seen = True
+            index += 1
+            continue
+        if "c" in token[1:]:
+            return SHELL_COMMAND_STRING
+        index += 1
+    return args[index] if index < len(args) else SHELL_STDIN
+
+
 def executed_scripts(tokens):
     """The files a command line will RUN, and the executions it cannot follow.
 
@@ -939,9 +1011,12 @@ def executed_scripts(tokens):
             if name in SOURCE_BUILTINS:
                 operand = arguments[0] if arguments else None
             elif name in SHELL_PROGRAMS:
-                operand = shell_script_operand(arguments)
-                if operand is None and not arguments:
+                operand = shell_execution_operand(arguments)
+                if operand is SHELL_STDIN:
                     previous_shell_awaiting_stdin = True
+                    continue
+                if operand is SHELL_COMMAND_STRING:
+                    continue
             else:
                 continue
             if operand is None:

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA67BjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAg2BjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA28BjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA82BjC,CAAC"}