@codyswann/lisa 4.34.4 → 4.34.6

package/dist/strategies/copy-overwrite.d.ts

@@ -68,6 +68,48 @@ export declare class CopyOverwriteStrategy implements ICopyStrategy {
      * @returns A preserved result when the copy is kept, else undefined
      */
     private preserveOwnedHostCopy;
+    /**
+     * Create a managed file the destination does not have.
+     *
+     * Its own method because this branch is where CodySwannGT/lisa#3501 lives.
+     * Every guard in {@link apply} asks whether THIS path exists, and each is
+     * blind to a differently-spelled file that outranks it: a repo configuring
+     * knip as `knip.ts` has no `knip.json`, so the template lands as a NEW file
+     * that knip then prefers, silently replacing the repo's own settings with
+     * stack defaults. The question has to be asked here, before the write,
+     * because there is no later branch — the create path is the whole defect.
+     * @param sourcePath - Packaged template path
+     * @param destPath - Installed file path, which does not yet exist
+     * @param relativePath - Repo-relative path for reporting
+     * @param context - Strategy context with config
+     * @returns The `copied` result, or `shadowed` when Lisa stands down
+     */
+    private createMissingFile;
+    /**
+     * The existing config file this template would outrank, if any.
+     *
+     * **Seed templates only, and the exclusion is the safety argument.** A
+     * template that declares `IS replaced on each` is a governance artifact —
+     * `eslint.config.ts`, `vitest.config.ts`, `commitlint.config.cjs`,
+     * `sgconfig.yml` — where writing the file IS the guardrail. Standing down
+     * because a same-family file exists would let any host silently disable
+     * Lisa's enforcement by dropping in an `eslint.config.js`, with nothing
+     * reporting it: #2374's undeliverable-fix incident re-entering through the
+     * door opened to fix #3501. For those, a same-family host file is a conflict
+     * to surface, never a reason not to write.
+     *
+     * Reuses `declaresReplacedEveryRun` rather than introducing a second notion
+     * of who owns a file. Two overlapping ownership definitions is how the next
+     * defect of this shape gets built.
+     *
+     * Returns a result only when Lisa is standing down, so the caller falls
+     * through to its normal create path in every other case.
+     * @param sourcePath - Packaged template path, read for its own declaration
+     * @param destPath - Installed file path, whose directory is the search root
+     * @param relativePath - Repo-relative path of the managed template
+     * @returns A `shadowed` result when the template is withheld, else undefined
+     */
+    private standDownForHostConfig;
     /**
      * Hold back a Lisa-owned refresh that cannot be proved to be an upgrade.
      *

package/dist/strategies/copy-overwrite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copy-overwrite.d.ts","sourceRoot":"","sources":["../../src/strategies/copy-overwrite.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAY7D,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG9E;;;;;;GAMG;AACH,qBAAa,qBAAsB,YAAW,aAAa;IACzD,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;IAE1C;;;;;;;OAOG;IACG,KAAK,CACT,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,mBAAmB,CAAC;IA8H/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,mBAAmB;IAwBjC;;;;;;;;;;;;;;;;;OAiBG;YACW,qBAAqB;IAkBnC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,mBAAmB;CAkClC"}
+{"version":3,"file":"copy-overwrite.d.ts","sourceRoot":"","sources":["../../src/strategies/copy-overwrite.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAgB7D,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG9E;;;;;;GAMG;AACH,qBAAa,qBAAsB,YAAW,aAAa;IACzD,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;IAE1C;;;;;;;OAOG;IACG,KAAK,CACT,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,mBAAmB,CAAC;IA+H/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,mBAAmB;IAwBjC;;;;;;;;;;;;;;;;;OAiBG;YACW,qBAAqB;IAkBnC;;;;;;;;;;;;;;;OAeG;YACW,iBAAiB;IAoB/B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,sBAAsB;IA2BpC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,mBAAmB;CAkClC"}

package/dist/strategies/copy-overwrite.js

@@ -1,6 +1,7 @@
 import * as fse from "fs-extra";
 import { copyFile, readFile } from "node:fs/promises";
 import { mayRefreshTemplate } from "../core/config.js";
+import { shadowedConfigNote, shadowedConfigSibling, } from "../core/config-shadowing.js";
 import { declaresReplacedEveryRun, isLisaOwnedTemplate, } from "../core/lisa-owned-templates.js";
 import { classifyHostCopy, describePreserved, describeUnclassifiable, mayRefreshLisaOwned, } from "../core/lisa-owned-provenance.js";
 import { filesIdentical, ensureParentDir } from "../utils/file-operations.js";
@@ -25,11 +26,7 @@ export class CopyOverwriteStrategy {
         const { config, backupFile, promptOverwrite } = context;
         const destExists = await fse.pathExists(destPath);
         if (!destExists) {
-            if (!config.dryRun) {
-                await ensureParentDir(destPath);
-                await copyFile(sourcePath, destPath);
-            }
-            return { relativePath, strategy: this.name, action: "copied" };
+            return this.createMissingFile(sourcePath, destPath, relativePath, context);
         }
         if (await filesIdentical(sourcePath, destPath)) {
             return { relativePath, strategy: this.name, action: "skipped" };
@@ -192,6 +189,73 @@ export class CopyOverwriteStrategy {
         }
         return this.preserveIfHostAhead(sourcePath, destPath, relativePath, context.hashLedger);
     }
+    /**
+     * Create a managed file the destination does not have.
+     *
+     * Its own method because this branch is where CodySwannGT/lisa#3501 lives.
+     * Every guard in {@link apply} asks whether THIS path exists, and each is
+     * blind to a differently-spelled file that outranks it: a repo configuring
+     * knip as `knip.ts` has no `knip.json`, so the template lands as a NEW file
+     * that knip then prefers, silently replacing the repo's own settings with
+     * stack defaults. The question has to be asked here, before the write,
+     * because there is no later branch — the create path is the whole defect.
+     * @param sourcePath - Packaged template path
+     * @param destPath - Installed file path, which does not yet exist
+     * @param relativePath - Repo-relative path for reporting
+     * @param context - Strategy context with config
+     * @returns The `copied` result, or `shadowed` when Lisa stands down
+     */
+    async createMissingFile(sourcePath, destPath, relativePath, context) {
+        const shadowed = await this.standDownForHostConfig(sourcePath, destPath, relativePath);
+        if (shadowed !== undefined)
+            return shadowed;
+        if (!context.config.dryRun) {
+            await ensureParentDir(destPath);
+            await copyFile(sourcePath, destPath);
+        }
+        return { relativePath, strategy: this.name, action: "copied" };
+    }
+    /**
+     * The existing config file this template would outrank, if any.
+     *
+     * **Seed templates only, and the exclusion is the safety argument.** A
+     * template that declares `IS replaced on each` is a governance artifact —
+     * `eslint.config.ts`, `vitest.config.ts`, `commitlint.config.cjs`,
+     * `sgconfig.yml` — where writing the file IS the guardrail. Standing down
+     * because a same-family file exists would let any host silently disable
+     * Lisa's enforcement by dropping in an `eslint.config.js`, with nothing
+     * reporting it: #2374's undeliverable-fix incident re-entering through the
+     * door opened to fix #3501. For those, a same-family host file is a conflict
+     * to surface, never a reason not to write.
+     *
+     * Reuses `declaresReplacedEveryRun` rather than introducing a second notion
+     * of who owns a file. Two overlapping ownership definitions is how the next
+     * defect of this shape gets built.
+     *
+     * Returns a result only when Lisa is standing down, so the caller falls
+     * through to its normal create path in every other case.
+     * @param sourcePath - Packaged template path, read for its own declaration
+     * @param destPath - Installed file path, whose directory is the search root
+     * @param relativePath - Repo-relative path of the managed template
+     * @returns A `shadowed` result when the template is withheld, else undefined
+     */
+    async standDownForHostConfig(sourcePath, destPath, relativePath) {
+        // Read once, ahead of any probe: the declaration is a property of the
+        // template, not of the candidate being tested.
+        if (declaresReplacedEveryRun(await readFile(sourcePath, "utf8"))) {
+            return undefined;
+        }
+        const projectRoot = destPath.slice(0, destPath.length - relativePath.length);
+        const shadowed = await shadowedConfigSibling(relativePath, candidate => fse.pathExists(`${projectRoot}${candidate}`));
+        if (shadowed === undefined)
+            return undefined;
+        return {
+            relativePath,
+            strategy: this.name,
+            action: "shadowed",
+            note: shadowedConfigNote(relativePath, shadowed.tool, shadowed.sibling),
+        };
+    }
     /**
      * Hold back a Lisa-owned refresh that cannot be proved to be an upgrade.
      *

package/dist/strategies/copy-overwrite.js.map

@@ -1 +1 @@
-{"version":3,"file":"copy-overwrite.js","sourceRoot":"","sources":["../../src/strategies/copy-overwrite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EACL,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,gBAAyB,CAAC;IAE1C;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CACT,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QACxD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAChC,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,MAAM,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QAED,yEAAyE;QACzE,qCAAqC;QACrC,EAAE;QACF,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,8DAA8D;QAC9D,gEAAgE;QAChE,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM;QACN,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAChD,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CACR,CAAC;QACF,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAE9C,sEAAsE;QACtE,yEAAyE;QACzE,2EAA2E;QAC3E,gBAAgB;QAChB,EAAE;QACF,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,wCAAwC;QACxC,EAAE;QACF,mEAAmE;QACnE,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,kEAAkE;QAClE,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,0CAA0C;QAC1C,EAAE;QACF,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,wBAAwB;QACxB,EAAE;QACF,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,gEAAgE;QAChE,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,EAAE;QACF,4EAA4E;QAC5E,mEAAmE;QACnE,sEAAsE;QACtE,4EAA4E;QAC5E,IACE,MAAM,CAAC,OAAO,KAAK,IAAI;YACvB,CAAC,mBAAmB,CAAC,YAAY,CAAC;YAClC,CAAC,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,gBAAgB,CAAC;YAC1D,CAAC,wBAAwB,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,EAC7D,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,mBAAmB,CAC7B,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CACR,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,eAAe,CAC3C,YAAY,EACZ,UAAU,EACV,QAAQ,CACT,CAAC;QAEF,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACrC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAEvC,IACE,CAAC,mBAAmB,CAAC,YAAY,CAAC;YAClC,CAAC,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC1D,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;QAED,wEAAwE;QACxE,mBAAmB;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,qBAAqB,CACjC,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC;YAAE,OAAO,SAAS,CAAC;QACzD,IAAI,kBAAkB,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAC7B,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CAAC,UAAU,CACnB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,MAAmB;QAEnB,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YACzC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO;gBACL,YAAY;gBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,MAAM,EAAE,YAAY;gBACpB,IAAI,EAAE,sBAAsB,CAAC,YAAY,EAAE,SAAS,KAAK,SAAS,CAAC;aACpE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,CAC9B,YAAY,EACZ,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAC;QACF,IAAI,mBAAmB,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QAEnD,OAAO;YACL,YAAY;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"copy-overwrite.js","sourceRoot":"","sources":["../../src/strategies/copy-overwrite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,gBAAyB,CAAC;IAE1C;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CACT,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QACxD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,iBAAiB,CAC3B,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CACR,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QAED,yEAAyE;QACzE,qCAAqC;QACrC,EAAE;QACF,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,8DAA8D;QAC9D,gEAAgE;QAChE,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM;QACN,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAChD,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CACR,CAAC;QACF,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAE9C,sEAAsE;QACtE,yEAAyE;QACzE,2EAA2E;QAC3E,gBAAgB;QAChB,EAAE;QACF,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,wCAAwC;QACxC,EAAE;QACF,mEAAmE;QACnE,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,kEAAkE;QAClE,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,0CAA0C;QAC1C,EAAE;QACF,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,wBAAwB;QACxB,EAAE;QACF,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,gEAAgE;QAChE,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,EAAE;QACF,4EAA4E;QAC5E,mEAAmE;QACnE,sEAAsE;QACtE,4EAA4E;QAC5E,IACE,MAAM,CAAC,OAAO,KAAK,IAAI;YACvB,CAAC,mBAAmB,CAAC,YAAY,CAAC;YAClC,CAAC,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,gBAAgB,CAAC;YAC1D,CAAC,wBAAwB,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,EAC7D,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,mBAAmB,CAC7B,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CACR,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,eAAe,CAC3C,YAAY,EACZ,UAAU,EACV,QAAQ,CACT,CAAC;QAEF,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACrC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAEvC,IACE,CAAC,mBAAmB,CAAC,YAAY,CAAC;YAClC,CAAC,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC1D,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;QAED,wEAAwE;QACxE,mBAAmB;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,qBAAqB,CACjC,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC;YAAE,OAAO,SAAS,CAAC;QACzD,IAAI,kBAAkB,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAC7B,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CAAC,UAAU,CACnB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,iBAAiB,CAC7B,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAChD,UAAU,EACV,QAAQ,EACR,YAAY,CACb,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAE5C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;YAChC,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACjE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,sBAAsB,CAClC,UAAkB,EAClB,QAAgB,EAChB,YAAoB;QAEpB,sEAAsE;QACtE,+CAA+C;QAC/C,IAAI,wBAAwB,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAChC,CAAC,EACD,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CACtC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,CACrE,GAAG,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,SAAS,EAAE,CAAC,CAC7C,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAE7C,OAAO;YACL,YAAY;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,kBAAkB,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC;SACxE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,MAAmB;QAEnB,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YACzC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO;gBACL,YAAY;gBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,MAAM,EAAE,YAAY;gBACpB,IAAI,EAAE,sBAAsB,CAAC,YAAY,EAAE,SAAS,KAAK,SAAS,CAAC;aACpE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,CAC9B,YAAY,EACZ,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAC;QACF,IAAI,mBAAmB,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QAEnD,OAAO;YACL,YAAY;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}

package/expo/copy-overwrite/scripts/check-lighthouse-details.mjs

@@ -9,7 +9,16 @@
  * table. Its score is effectively binary, so a score floor makes unchanged
  * pages alternate between green and red as runner timing changes. LHCI writes
  * the measurement into each LHR; this checker applies a real millisecond
- * ceiling to every collected run.
+ * ceiling to that evidence.
+ *
+ * The ceiling is asserted against the **median of a URL's runs**, not against
+ * any single run. A forced-reflow regression is deterministic — code that
+ * reads layout inside a loop does so on every load — so it moves the median.
+ * A single cold run does not: the first Lighthouse run of a URL, immediately
+ * after the runs of the previous URL, routinely reports a warmup spike that no
+ * later run of the same URL reproduces. Asserting a maximum made that spike
+ * indistinguishable from a regression, so the gate's verdict was uncorrelated
+ * with the change under review.
  * @module scripts/check-lighthouse-details
  */
 
@@ -21,6 +30,29 @@ const CONFIG_FILE = "lighthouserc-config.json";
 const REPORT_DIRECTORY = ".lighthouseci";
 const REPORT_PATTERN = /^lhr-.*\.json$/;
 const DEFAULT_MAX_FORCED_REFLOW_MS = 100;
+const RUN_COUNT_SETTING = "collect.numberOfRuns";
+
+/**
+ * Fewest runs per URL that a median can absorb a warmup spike from.
+ *
+ * With two samples the median is their mean, so one cold spike still drags the
+ * statistic halfway to itself — the defect survives, attenuated. Three is the
+ * smallest count at which a single outlier cannot move the median at all.
+ */
+const MINIMUM_SAMPLES_PER_URL = 3;
+
+/**
+ * LHR fields naming the audited page, best first.
+ *
+ * Lighthouse renamed `finalUrl` to `finalDisplayedUrl` and reports differ by
+ * version, so grouping cannot depend on any single one of them.
+ */
+const URL_FIELDS = [
+  "finalUrl",
+  "finalDisplayedUrl",
+  "requestedUrl",
+  "mainDocumentUrl",
+];
 
 /**
  * Read the bottom-up aggregate table from one forced-reflow audit.
@@ -66,10 +98,43 @@ function readAggregateMeasurements(details) {
   });
 }
 
+/**
+ * Identify which page one Lighthouse result measured.
+ * Samples are grouped by this value, so an unidentifiable report is a hard
+ * failure rather than a group of its own — a report grouped alone would be
+ * reported as a run-count shortfall, which names the wrong remedy.
+ * @param {Record<string, unknown>} report - Parsed LHR
+ * @returns {string} Audited URL
+ */
+function readReportUrl(report) {
+  for (const field of URL_FIELDS) {
+    const value = report?.[field];
+    if (typeof value === "string" && value.length > 0) {
+      return value;
+    }
+  }
+  throw new Error(
+    `no URL to group runs by; expected one of ${URL_FIELDS.join(", ")}`
+  );
+}
+
+/**
+ * Middle value of a sample set, averaging the two middles when even.
+ * @param {readonly number[]} values - Non-empty sample set
+ * @returns {number} Median
+ */
+function median(values) {
+  const sorted = [...values].sort((first, second) => first - second);
+  const middle = Math.floor(sorted.length / 2);
+  return sorted.length % 2 === 0
+    ? (sorted[middle - 1] + sorted[middle]) / 2
+    : sorted[middle];
+}
+
 /**
  * Read the host threshold, falling back to Lisa's shipped default.
  * @param {string} projectRoot - Host project root
- * @returns {number} Maximum forced-reflow duration per Lighthouse run
+ * @returns {number} Maximum median forced-reflow duration per URL
  */
 function readMaximum(projectRoot) {
   const configPath = path.join(projectRoot, CONFIG_FILE);
@@ -116,10 +181,12 @@ function readReport(reportPath) {
   }
 }
 
-/** Run the detail budget against the current project. */
-function main() {
-  const projectRoot = process.cwd();
-  const maximum = readMaximum(projectRoot);
+/**
+ * List the Lighthouse result files, refusing to pass on absent evidence.
+ * @param {string} projectRoot - Host project root
+ * @returns {string[]} LHR paths, sorted
+ */
+function readReportPaths(projectRoot) {
   const reportDirectory = path.join(projectRoot, REPORT_DIRECTORY);
   if (!fs.existsSync(reportDirectory)) {
     throw new Error(
@@ -134,9 +201,19 @@ function main() {
   if (reportPaths.length === 0) {
     throw new Error(`${REPORT_DIRECTORY} contains no Lighthouse result JSON`);
   }
+  return reportPaths;
+}
 
+/**
+ * Total the forced-reflow evidence in every report, grouped by audited URL.
+ * Evidence-integrity problems are collected rather than thrown so that one
+ * malformed report names itself instead of masking the rest.
+ * @param {readonly string[]} reportPaths - LHR paths
+ * @returns {{ samplesByUrl: Map<string, number[]>, failures: string[] }} Totals and integrity failures
+ */
+function collectSamples(reportPaths) {
+  const samplesByUrl = new Map();
   const failures = [];
-  let observedMaximum = 0;
   for (const reportPath of reportPaths) {
     const report = readReport(reportPath);
     const audit = report?.audits?.[AUDIT_ID];
@@ -145,8 +222,10 @@ function main() {
       continue;
     }
     let measurements;
+    let url;
     try {
       measurements = readAggregateMeasurements(audit.details);
+      url = readReportUrl(report);
     } catch (error) {
       failures.push(
         `${path.basename(reportPath)}: ${error instanceof Error ? error.message : String(error)}`
@@ -163,21 +242,69 @@ function main() {
       (sum, measurement) => sum + measurement,
       0
     );
-    observedMaximum = Math.max(observedMaximum, total);
-    if (total > maximum) {
+    const samples = samplesByUrl.get(url);
+    if (samples) {
+      samples.push(total);
+    } else {
+      samplesByUrl.set(url, [total]);
+    }
+  }
+  return { samplesByUrl, failures };
+}
+
+/**
+ * Assert the configured ceiling against each URL's median.
+ * A URL with too few runs fails rather than falling back to a maximum, because
+ * the median of one sample is that sample: without this, `numberOfRuns: 1`
+ * would silently restore a per-run maximum under the name of a median.
+ * @param {Map<string, number[]>} samplesByUrl - Per-URL run totals
+ * @param {number} maximum - Configured millisecond ceiling
+ * @returns {{ failures: string[], largestMedian: number }} Budget failures and the largest median seen
+ */
+function assertMedians(samplesByUrl, maximum) {
+  const failures = [];
+  let largestMedian = 0;
+  for (const [url, samples] of samplesByUrl) {
+    if (samples.length < MINIMUM_SAMPLES_PER_URL) {
+      failures.push(
+        `${url}: ${samples.length} run${samples.length === 1 ? "" : "s"} is fewer than the ${MINIMUM_SAMPLES_PER_URL} needed for a median; raise ${RUN_COUNT_SETTING} in ${CONFIG_FILE} to at least ${MINIMUM_SAMPLES_PER_URL}`
+      );
+      continue;
+    }
+    const middle = median(samples);
+    largestMedian = Math.max(largestMedian, middle);
+    if (middle > maximum) {
       failures.push(
-        `${report.finalUrl ?? path.basename(reportPath)}: ${total.toFixed(1)} ms exceeds ${maximum} ms`
+        `${url}: median ${middle.toFixed(1)} ms of ${samples.length} runs exceeds ${maximum} ms`
       );
     }
   }
+  return { failures, largestMedian };
+}
 
+/** Run the detail budget against the current project. */
+function main() {
+  const projectRoot = process.cwd();
+  const maximum = readMaximum(projectRoot);
+  const reportPaths = readReportPaths(projectRoot);
+
+  const { samplesByUrl, failures: evidenceFailures } =
+    collectSamples(reportPaths);
+  if (evidenceFailures.length > 0) {
+    throw new Error(
+      `forced-reflow detail budget failed:\n${evidenceFailures.map(failure => `- ${failure}`).join("\n")}`
+    );
+  }
+
+  const { failures, largestMedian } = assertMedians(samplesByUrl, maximum);
   if (failures.length > 0) {
     throw new Error(
       `forced-reflow detail budget failed:\n${failures.map(failure => `- ${failure}`).join("\n")}`
     );
   }
+
   console.log(
-    `lighthouse detail budget passed: ${reportPaths.length} report(s), forced reflow <= ${maximum} ms (max ${observedMaximum.toFixed(1)} ms)`
+    `lighthouse detail budget passed: ${reportPaths.length} report(s) across ${samplesByUrl.size} URL(s), forced reflow median <= ${maximum} ms (largest median ${largestMedian.toFixed(1)} ms)`
   );
 }
 

package/expo/create-only/.github/workflows/deploy.yml

@@ -211,14 +211,61 @@ jobs:
         release,
         check_app_config_changes,
       ]
-    # Run if EAS is set up, regardless of whether trigger_eas_build ran or was skipped
+    # Runs when EAS is set up, regardless of whether trigger_eas_build ran or
+    # was skipped — and, deliberately, EVEN WHEN THE RELEASE DID NOT SUCCEED.
+    #
+    # This condition used to end in `needs.release.result == 'success'`, which
+    # made a failed release SKIP this job. GitHub renders a skipped job as
+    # neutral and treats a skipped required check as satisfied, so a deploy that
+    # never happened left no signal anywhere: the branch still had its release
+    # commit, versions still matched across branches, and nothing prompted
+    # anyone to go read CI history for skipped Deploy jobs. The release result
+    # is now read by the guard STEP below, which fails this job loudly (#3467).
+    #
+    # `!cancelled()` rather than `always()`: it still suppresses the implicit
+    # `success()`, so the job runs on a failed release, while a run an operator
+    # cancelled does not get a verdict it never earned. EAS not being set up is
+    # a genuine "not applicable" and still skips.
     if: |
-      always() && 
-      needs.check_eas_setup.outputs.has_eas_setup == 'true' &&
-      needs.release.result == 'success'
+      !cancelled() &&
+      needs.check_eas_setup.outputs.has_eas_setup == 'true'
     permissions:
       contents: read
     steps:
+      # Deploy-outcome guard. Deliberately the FIRST step: it decides whether the
+      # rest of this job may proceed, and it reports a verdict on EVERY run, so
+      # this check is green or red and never the third, silent state.
+      #
+      # Keep the `run:` body byte-identical to the guard in every other Lisa
+      # deploy workflow — an operator reads the same words whichever stack they
+      # are on, and a test asserts the copies have not drifted apart.
+      - name: 🚨 Confirm the release shipped
+        env:
+          DEPLOY_ENVIRONMENT: ${{ needs.determine_environment.outputs.environment }}
+          RELEASE_RESULT: ${{ needs.release.result }}
+        run: |
+          if [ "${RELEASE_RESULT}" = "success" ]; then
+            echo "✅ The release succeeded. Deploying to ${DEPLOY_ENVIRONMENT}."
+            exit 0
+          fi
+          {
+            echo "### 🚨 Nothing new was deployed to ${DEPLOY_ENVIRONMENT}"
+            echo ""
+            echo "The **Release** step did not succeed (it reported \`${RELEASE_RESULT}\`), so no"
+            echo "new version reached \`${DEPLOY_ENVIRONMENT}\`. Whatever was already running"
+            echo "there is untouched and still working — this change simply has not shipped."
+            echo ""
+            echo "**What to do next**"
+            echo ""
+            echo "1. Open the **Release** job in this run and read the step marked in red."
+            echo "2. The most common cause is that this version number was already released from"
+            echo "   another branch. The fix is to raise \`version\` in \`package.json\` above every"
+            echo "   version already released, then merge again."
+            echo "3. If anything here is unclear, send this run's link to whoever looks after"
+            echo "   deployments. Do not merge anything else into this branch until it is fixed."
+          } >> "${GITHUB_STEP_SUMMARY:-/dev/stdout}"
+          echo "::error title=Nothing new was deployed to ${DEPLOY_ENVIRONMENT}::The release did not succeed (${RELEASE_RESULT}), so this change did not ship and the previous version is still running. Open the Release job in this run to see why, fix it, then merge again."
+          exit 1
       - name: Checkout repository
         uses: actions/checkout@v6
         with:

package/package.json

@@ -166,7 +166,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.34.4",
+  "version": "4.34.6",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -314,7 +314,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "5c67eb33f92bb76e47023e4588b92dd9bd178cfd",
-  "gitHead": "5c67eb33f92bb76e47023e4588b92dd9bd178cfd",
-  "lisaReleaseTag": "v4.34.4"
+  "lisaReleaseCommit": "825a67c494db413e3fb3305e1db7c2048d8ecdfa",
+  "gitHead": "825a67c494db413e3fb3305e1db7c2048d8ecdfa",
+  "lisaReleaseTag": "v4.34.6"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.34.4",
+  "version": "4.34.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.34.4",
+  "version": "4.34.6",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"