@codyswann/lisa 4.35.0 → 4.35.1

package/all/copy-overwrite/scripts/check-npm-publish-landed.mjs

@@ -60,6 +60,9 @@ const DEFAULT_ATTEMPTS = 5;
 /** Pause between attempts, in milliseconds. */
 const DEFAULT_DELAY_MS = 3000;
 
+/** Maximum wall time for one registry attempt, including body parsing. */
+const DEFAULT_ATTEMPT_TIMEOUT_MS = 10_000;
+
 /** The line a caller greps for. Never printed without a real verdict behind it. */
 const VERDICT_PREFIX = "npm-publish-landed:";
 
@@ -90,42 +93,52 @@ export function exactVersionUrl(registry, name, version) {
  * @param {string} url - The exact-version manifest URL.
  * @param {typeof fetch} fetchImpl - Injected for tests.
  * @param {string} version - The version the answer must name.
+ * @param {object} timeout - Per-attempt deadline dependencies.
+ * @param {number} timeout.attemptTimeoutMs - Deadline in milliseconds.
+ * @param {() => AbortController} timeout.createAbortController - Controller factory.
+ * @param {typeof setTimeout} timeout.setAttemptTimer - Timer scheduler.
+ * @param {typeof clearTimeout} timeout.clearAttemptTimer - Timer clearer.
  * @returns {Promise<{verdict: string, detail: string}>} One attempt's outcome.
  */
-async function askOnce(url, fetchImpl, version) {
-  let response;
+async function askOnce(url, fetchImpl, version, timeout) {
+  const controller = timeout.createAbortController();
+  const timer = timeout.setAttemptTimer(
+    () => controller.abort(),
+    timeout.attemptTimeoutMs
+  );
   try {
-    response = await fetchImpl(url, {
+    const response = await fetchImpl(url, {
       headers: { accept: "application/json" },
+      signal: controller.signal,
     });
-  } catch (error) {
-    return { verdict: "unprovable", detail: `network: ${error.message}` };
-  }
-  if (response.status === 404) {
-    return { verdict: "missing", detail: "registry returned 404" };
-  }
-  if (!response.ok) {
-    return { verdict: "unprovable", detail: `HTTP ${response.status}` };
-  }
-  let manifest;
-  try {
-    manifest = await response.json();
-  } catch (error) {
+    if (response.status === 404) {
+      return { verdict: "missing", detail: "registry returned 404" };
+    }
+    if (!response.ok) {
+      return { verdict: "unprovable", detail: `HTTP ${response.status}` };
+    }
+    const manifest = await response.json();
+    // A 200 that names a different version is not this version being present.
+    if (manifest?.version !== version) {
+      return {
+        verdict: "unprovable",
+        detail: `HTTP 200 but the body names version ${String(manifest?.version)}`,
+      };
+    }
     return {
-      verdict: "unprovable",
-      detail: `unparseable body: ${error.message}`,
+      verdict: "published",
+      detail: "registry served this exact version",
     };
-  }
-  // A 200 that names a different version is not this version being present. The
-  // registry is not expected to do this; treating it as proof anyway is how a
-  // surprise becomes a silent pass.
-  if (manifest?.version !== version) {
+  } catch (error) {
     return {
       verdict: "unprovable",
-      detail: `HTTP 200 but the body names version ${String(manifest?.version)}`,
+      detail: controller.signal.aborted
+        ? `attempt exceeded ${String(timeout.attemptTimeoutMs)}ms deadline`
+        : `network or body: ${error.message}`,
     };
+  } finally {
+    timeout.clearAttemptTimer(timer);
   }
-  return { verdict: "published", detail: "registry served this exact version" };
 }
 
 /**
@@ -149,6 +162,7 @@ const worthRetrying = verdict => verdict !== "published";
  * @param {string} [options.registry] - Registry origin.
  * @param {number} [options.attempts] - How many times to ask.
  * @param {number} [options.delayMs] - Pause between attempts.
+ * @param {number} [options.attemptTimeoutMs] - Deadline for each attempt.
  * @param {typeof fetch} [options.fetchImpl] - Injected for tests.
  * @param {(ms: number) => Promise<void>} [options.sleep] - Injected for tests.
  * @returns {Promise<{verdict: string, detail: string, urls: string[]}>} Outcome.
@@ -159,15 +173,24 @@ export async function verifyPublish({
   registry = DEFAULT_REGISTRY,
   attempts = DEFAULT_ATTEMPTS,
   delayMs = DEFAULT_DELAY_MS,
+  attemptTimeoutMs = DEFAULT_ATTEMPT_TIMEOUT_MS,
   fetchImpl = fetch,
   sleep = ms => new Promise(resolve => setTimeout(resolve, ms)),
+  createAbortController = () => new AbortController(),
+  setAttemptTimer = setTimeout,
+  clearAttemptTimer = clearTimeout,
 }) {
   const url = exactVersionUrl(registry, packageName, version);
   const urls = [];
   let outcome = { verdict: "unprovable", detail: "no attempt was made" };
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
     urls.push(url);
-    outcome = await askOnce(url, fetchImpl, version);
+    outcome = await askOnce(url, fetchImpl, version, {
+      attemptTimeoutMs,
+      createAbortController,
+      setAttemptTimer,
+      clearAttemptTimer,
+    });
     if (!worthRetrying(outcome.verdict)) break;
     if (attempt < attempts) await sleep(delayMs);
   }

package/all/copy-overwrite/scripts/lib/kill-marks.mjs

@@ -164,6 +164,7 @@ export function recentKillMarks(deps = {}) {
       })
       .filter(mark => mark !== null && mark.schema === 1)
       .filter(mark => Number.isFinite(mark.at))
+      .filter(mark => mark.at <= now)
       .filter(mark => now - mark.at <= KILL_MARK_RETENTION_MS)
       .sort((left, right) => right.at - left.at);
   } catch {

package/all/copy-overwrite/scripts/lisa-hooks/block-direct-issue-create.sh

@@ -1429,7 +1429,11 @@ EXEC_WRAPPERS = {
     "nohup": (frozenset(), 0),
     "setsid": (frozenset(), 0),
     "stdbuf": (frozenset({"-i", "-o", "-e"}), 0),
-    "sudo": (frozenset({"-u", "--user", "-g", "--group", "-C", "--close-from"}), 0),
+    "sudo": (frozenset({
+        "-u", "--user", "-g", "--group", "-C", "--close-from",
+        "-p", "--prompt", "-h", "--host", "-r", "--role",
+        "-t", "--type", "-U", "--other-user",
+    }), 0),
     "time": (frozenset(), 0),
     "timeout": (frozenset({"-k", "--kill-after", "-s", "--signal"}), 1),
 }
@@ -1450,6 +1454,31 @@ NO_SCRIPT_OPTIONS = {
     "ruby": {"-e"},
 }
 
+# Interpreter switches whose value is a separate token, followed by the real
+# script operand. Treating the value as the script makes the guard inspect a
+# preload or option value and never reach what the interpreter executes.
+INTERPRETER_VALUE_OPTIONS = {
+    "bash": {"-o", "--option"},
+    "dash": {"-o"},
+    "deno": {"-c", "--config"},
+    "ksh": {"-o"},
+    "node": {"-r", "--require"},
+    "nodejs": {"-r", "--require"},
+    "sh": {"-o"},
+    "zsh": {"-o"},
+}
+
+# Runtime subcommands that introduce the script path rather than name it.
+INTERPRETER_SUBCOMMANDS = {
+    "bun": {"run"},
+    "deno": {"run"},
+}
+
+
+def is_assignment_word(token):
+    """Whether token is a POSIX shell assignment in command-prefix position."""
+    return re.match(r"^[A-Za-z_][A-Za-z0-9_]*\+?=", token) is not None
+
 # Programs that READ their operands and never execute them as programs.
 #
 # This is an allowlist of readers rather than the inverse, and the asymmetry is
@@ -1504,7 +1533,7 @@ def executing_command(argv):
     index = 0
     while index < len(argv):
         token = argv[index]
-        if "=" in token and not token.startswith(("=", "-")):
+        if is_assignment_word(token):
             index += 1
             continue
         program = basename(token)
@@ -1571,16 +1600,20 @@ def executed_operand(argv):
     # shebang — `./create.sh` names no interpreter and runs all the same.
     if program not in EXECUTING_INTERPRETERS and resolve_operand(token) is not None:
         return token
-    # `bash < create.sh` runs that file as surely as `bash create.sh` does, and
-    # `<` is not a segment boundary, so the pair survives in one argv.
-    for index, argument in enumerate(args):
-        if argument == "<" and index + 1 < len(args):
-            return args[index + 1]
     # Reached by a known interpreter AND by a program this parser cannot name.
     # The unknown case is followed on purpose — see READ_ONLY_PROGRAMS.
-    for argument in args:
-        if argument == "--":
+    redirected = None
+    index = 0
+    while index < len(args):
+        argument = args[index]
+        if argument == "<":
+            if index + 1 < len(args):
+                redirected = args[index + 1]
+            index += 2
             continue
+        if argument == "--":
+            index += 1
+            return args[index] if index < len(args) else redirected
         if argument.startswith("-"):
             # A command string or a module name; no script file follows.
             head = argument.split("=", 1)[0]
@@ -1591,9 +1624,15 @@ def executed_operand(argv):
                     return None
             elif head in NO_SCRIPT_OPTIONS.get(program, set()):
                 return None
+            takes_value = head in INTERPRETER_VALUE_OPTIONS.get(program, set())
+            index += 2 if takes_value and "=" not in argument else 1
+            continue
+        if argument in INTERPRETER_SUBCOMMANDS.get(program, set()):
+            index += 1
             continue
         return argument
-    return None
+    # `bash < create.sh` runs stdin only when no explicit script was named.
+    return redirected
 
 
 def file_operands(argv):

package/all/copy-overwrite/scripts/lisa-hooks/block-managed-file-edits.sh

@@ -93,7 +93,7 @@
 # from mine", and guessing "behind" is how a fork's stronger guard gets silently
 # replaced by a weaker upstream one. Add a name here in the same commit that
 # closes a vector.
-# lisa-guard-capabilities: managed-path-resolution, lisaignore-precedence, generated-path-rebuild, redirect-target, tee-target, sed-in-place-all-spellings, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand, direct-script-command-reach, analyzer-failure-visible
+# lisa-guard-capabilities: managed-path-resolution, lisaignore-precedence, generated-path-rebuild, redirect-target, tee-target, sed-in-place-all-spellings, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand, direct-script-command-reach, analyzer-failure-visible, apply-patch-parse-failure-visible, apply-patch-move-target, shell-command-string-reach
 set -euo pipefail
 
 input="$(cat)"
@@ -402,6 +402,7 @@ case "$tool_name" in
     #   *** Add File: <path>
     #   *** Update File: <path>
     #   *** Delete File: <path>
+    #   *** Move to: <path>
     #
     # So every header is walked and each target classified; one managed
     # target anywhere in a multi-file patch refuses the whole call, because
@@ -418,14 +419,25 @@ case "$tool_name" in
     # legitimately cannot be one file. What is NOT restated is the
     # classification: `managed_source` and `refuse` are the single copy here,
     # exactly as for every other arm.
-    patch_text="$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || true)"
+    if ! patch_text="$(printf '%s' "$input" | jq -er '
+      if ((.tool_input.command? // "") | type) == "string"
+      then (.tool_input.command? // "")
+      else error("tool_input.command must be a string")
+      end')"; then
+      printf 'block-managed-file-edits: could not parse the apply_patch command; managed-file protection refused the edit\n' >&2
+      exit 2
+    fi
     [ -n "$patch_text" ] || exit 0
     while IFS= read -r patch_line; do
       case "$patch_line" in
-        "*** Add File: "* | "*** Update File: "* | "*** Delete File: "*) ;;
+        "*** Add File: "* | "*** Update File: "* | "*** Delete File: "*)
+          candidate="${patch_line#*File: }"
+          ;;
+        "*** Move to: "*)
+          candidate="${patch_line#*** Move to: }"
+          ;;
         *) continue ;;
       esac
-      candidate="${patch_line#*File: }"
       [ -n "$candidate" ] || continue
       if source_path="$(managed_source "$candidate")"; then
         refuse "$candidate" "$source_path" "$(relative_path "$candidate")"
@@ -715,6 +727,29 @@ def shell_script_operand(args):
     return None
 
 
+def shell_command_string(statement):
+    """The inline command a shell executes with `-c`, or None.
+
+    Args:
+        statement: One statement's tokens.
+
+    Returns:
+        The command string operand, or None when this is not a shell `-c` call.
+    """
+    _token, program, args = command_word(statement)
+    if program not in SHELL_PROGRAMS:
+        return None
+    for index, token in enumerate(args):
+        if token == "--":
+            return None
+        if token.startswith("-") and not token.startswith("--") and "c" in token[1:]:
+            command_index = index + 1
+            if command_index < len(args) and args[command_index] == "--":
+                command_index += 1
+            return args[command_index] if command_index < len(args) else None
+    return None
+
+
 def write_targets(statement):
     """Paths this statement WRITES.
 
@@ -837,6 +872,9 @@ def collect(text, depth, seen, out):
         if not statement:
             continue
         out.extend(write_targets(statement))
+        nested = shell_command_string(statement)
+        if nested is not None and depth < FOLLOW_MAX_DEPTH:
+            collect(nested, depth + 1, seen, out)
         operand = executed_script(statement)
         if operand is None:
             continue

package/all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh

@@ -182,12 +182,14 @@ EOF
 # The patch file is per-worktree: `mktemp` names it, so nothing has to invent a
 # filename, and it lives in this agent's own TMPDIR where no sibling can reach
 # it. Untracked files are unaffected by both refused operations, so `git diff`
-# captures everything at risk.
+# captures everything at risk. `HEAD` includes staged and unstaged changes, and
+# `--binary` keeps binary edits recoverable rather than emitting a text-only
+# placeholder that cannot be applied.
 PRESERVE_GUIDANCE="$(
   cat <<'EOF'
 Preserve the work first, per-worktree:
 
-  git diff [-- <path>] > "$(mktemp "${TMPDIR:-/tmp}/lisa-preserve-XXXXXX.patch")"
+  git diff --binary HEAD [-- <path>] > "$(mktemp "${TMPDIR:-/tmp}/lisa-preserve-XXXXXX.patch")"
 
 and restore it later with `git apply <that file>`.
 
@@ -447,6 +449,7 @@ follow_refuse() {
 # so peak process count never rises. The latency was the whole problem.
 follow_unwrapped=""
 follow_operand_index=0
+follow_located=""
 
 # Strip substitution, quote and alias wrappers off one token. A sibling of
 # strip_subst_wrappers() below rather than a call to it: that one is defined
@@ -571,6 +574,7 @@ follow_add_base() {
 # this hook cannot evaluate.
 follow_locate() {
   local token="$1" home="${HOME:-}" tmp="${TMPDIR:-/tmp}" proj="${CLAUDE_PROJECT_DIR:-$PWD}" base
+  follow_located=""
   tmp="${tmp%/}"
   [ -n "$tmp" ] || tmp="/tmp"
   # The tilde arms below are LITERAL text: this is the unexpanded spelling the
@@ -592,14 +596,14 @@ follow_locate() {
     "" | *'$'* | *'*'* | *'?'* | *'`'* | *'{'* | *'['*) return 1 ;;
     /*)
       [ -f "$token" ] && [ -r "$token" ] || return 1
-      printf '%s' "$token"
+      follow_located="$token"
       return 0
       ;;
   esac
   while IFS= read -r base; do
     [ -n "$base" ] || continue
     if [ -f "$base/$token" ] && [ -r "$base/$token" ]; then
-      printf '%s' "$base/$token"
+      follow_located="$base/$token"
       return 0
     fi
   done <<<"$PWD"$'\n'"$proj$follow_bases"
@@ -644,12 +648,13 @@ follow_take() {
 follow_target() {
   local token="$1" depth="$2" path=""
   [ -n "$token" ] || return 0
-  if ! path="$(follow_locate "$token")"; then
+  if ! follow_locate "$token"; then
     if [ "$depth" -eq 0 ]; then
       follow_refuse "$token" "no readable file could be resolved for it"
     fi
     return 0
   fi
+  path="$follow_located"
   follow_take "$path" "$depth"
 }
 
@@ -670,11 +675,18 @@ follow_target() {
 # Accepted residual: a shebang script whose relative path resolves only from a
 # working directory this hook does not share is not followed.
 follow_direct() {
-  local token="$1" depth="$2" path="" first=""
-  if ! path="$(follow_locate "$token")"; then
+  local token="$1" depth="$2" path="" first="" raw="" char="" k=0
+  local LC_ALL=C
+  if ! follow_locate "$token"; then
     return 0
   fi
-  first="$(LC_ALL=C head -c 256 -- "$path" 2>/dev/null | LC_ALL=C head -n 1 2>/dev/null | LC_ALL=C tr -dc '[:print:]' 2>/dev/null)" || first=""
+  path="$follow_located"
+  IFS= read -r -n 256 raw <"$path" 2>/dev/null || true
+  while [ "$k" -lt "${#raw}" ]; do
+    char="${raw:k:1}"
+    case "$char" in [[:print:]]) first="$first$char" ;; esac
+    k=$((k + 1))
+  done
   case "$first" in
     '#!'*[/[:space:]]bash* | '#!'*[/[:space:]]sh* | '#!'*[/[:space:]]zsh* \
       | '#!'*[/[:space:]]ksh* | '#!'*[/[:space:]]dash* | '#!'*[/[:space:]]ash*) ;;
@@ -704,7 +716,7 @@ follow_next_operand() {
 follow_scan() {
   local text="$1" depth="$2"
   local split_out line sep stmt t tj i j n cmd_pos eval_mode inline arg_exec
-  local heredoc redirected pipe_cat prev_cat pending_operand
+  local heredoc redirected pipe_cat prev_cat pending_operand stdin_mode
   local find_mode dispatch_pending
   local -a toks=()
   split_out="$(follow_split "$text")"
@@ -891,6 +903,7 @@ follow_scan() {
         inline=0
         redirected=""
         heredoc=0
+        stdin_mode=0
         j=$((i + 1))
         while [ "$j" -lt "$n" ]; do
           follow_unwrap "${toks[j]}"
@@ -923,6 +936,7 @@ follow_scan() {
               ;;
             --*) j=$((j + 1)) ;;
             -*c*) inline=1; j=$((j + 1)) ;;
+            -s | -[a-zA-Z]*s[a-zA-Z]*) stdin_mode=1; j=$((j + 1)) ;;
             -*) j=$((j + 1)) ;;
             *) break ;;
           esac
@@ -947,6 +961,14 @@ follow_scan() {
           i="$j"
           continue
         fi
+        if [ "$stdin_mode" -eq 1 ]; then
+          # `sh -s -- -y` reads its program from stdin; tokens after `--` are
+          # positional arguments to that program, never a script path.
+          [ -z "$pipe_cat" ] || follow_target "$pipe_cat" "$depth"
+          cmd_pos=0
+          i="$n"
+          continue
+        fi
         if [ "$j" -ge "$n" ]; then
           # A dispatcher supplies the script from ANOTHER command's output, so
           # the operand exists but is unreadable here. That is the fail-closed
@@ -1809,15 +1831,14 @@ readonly SQL_TRUNCATE_EVIDENCE='\btruncate[[:space:]]+(table[[:space:]]+[[:alnum
 # the same command must also invoke a command-line database client. Prose in a
 # tracker filing or a commit message invokes none, which is exactly the
 # difference the text scan could not see on its own.
-readonly SQL_CLIENT='(^|[^[:alnum:]_./-])([[:alnum:]_./-]*/)?(psql|pgcli|mysql|mysqladmin|mysqlsh|mariadb|mycli|sqlite3|sqlcmd|cqlsh|clickhouse-client|cockroach|mongosh|duckdb|usql)([[:space:]]|$)'
-readonly SQL_TRUNCATE_BARE='\btruncate[[:space:]]+(only[[:space:]]+)?[[:alnum:]_."`]'
+readonly SQL_CLIENT_TRUNCATE='(^|[;&|()][[:space:]]*)([[:alnum:]_./-]*/)?(psql|pgcli|mysql|mysqladmin|mysqlsh|mariadb|mycli|sqlite3|sqlcmd|cqlsh|clickhouse-client|cockroach|mongosh|duckdb|usql)([[:space:]]+[^;&|()]*)?[[:space:]]+(-e|-c|--command|--eval)(=|[[:space:]]+)[^;&|()]*\btruncate[[:space:]]+(only[[:space:]]+)?[[:alnum:]_."`]'
 # Residual, accepted and stated: a bare `TRUNCATE <name>` with no terminator,
 # no qualification and no recognized client in the same command goes unmatched
 # — the same trade the `drop` arm has always made for `drop the ball`. No DROP
 # shape is weakened, and the guard still fails in the safe direction.
 if matches "$SQL_DROP" \
   || matches "$SQL_TRUNCATE_EVIDENCE" \
-  || { matches "$SQL_CLIENT" && matches "$SQL_TRUNCATE_BARE"; }; then
+  || matches "$SQL_CLIENT_TRUNCATE"; then
   block "destructive SQL (DROP/TRUNCATE) detected"
 fi
 

package/all/copy-overwrite/scripts/lisa-run-gates.mjs

@@ -1322,9 +1322,10 @@ function inputsDigest() {
  * @param {object|null} options.gates The gates block that was executed.
  * @param {string} [options.runner] The task-runner prefix.
  * @param {Record<string,string>|null} [options.scripts] Project scripts.
+ * @param {object} options.identity Lisa artifact identity captured at run start.
  * @returns {object} The contract binding.
  */
-function evidenceContract({ moment, gates, runner, scripts = null }) {
+function evidenceContract({ moment, gates, runner, scripts = null, identity }) {
   return {
     moment,
     runner: runner ?? null,
@@ -1337,7 +1338,7 @@ function evidenceContract({ moment, gates, runner, scripts = null }) {
     // produced the verdict — a fact a workflow ref cannot carry, because the
     // wrapper's identity and the enforcement's identity are independent when
     // the enforcement is a file living in the consuming repository.
-    ...lisaIdentity(),
+    ...identity,
     inputs_digest: inputsDigest(),
   };
 }
@@ -1484,6 +1485,7 @@ function gateEvidence(outcome, observedAt) {
  * @param {string} [options.runner] The task-runner prefix.
  * @param {Record<string,string>|null} [options.scripts] Project scripts.
  * @param {string} options.observedAt When the run began, ISO-8601.
+ * @param {object} [options.identity] Lisa identity captured for this run.
  * @returns {object} The evidence envelope.
  */
 export function evidenceDocument({
@@ -1494,6 +1496,7 @@ export function evidenceDocument({
   runner = undefined,
   scripts = null,
   observedAt,
+  identity = lisaIdentity(),
 }) {
   const observations = (result?.results ?? []).map(outcome =>
     gateEvidence(outcome, observedAt)
@@ -1502,7 +1505,7 @@ export function evidenceDocument({
     schema: EVIDENCE_SCHEMA,
     verdict,
     subject: evidenceSubject(),
-    contract: evidenceContract({ gates, moment, runner, scripts }),
+    contract: evidenceContract({ gates, moment, runner, scripts, identity }),
     producer: evidenceProducer(),
     observed_at: observedAt,
     gates: observations,
@@ -1644,7 +1647,8 @@ function main() {
   // defect this line exists to close: the local hook runs the version this
   // project PINNED, while CI runs a floating ref, so two reports about "the
   // gate" are routinely claims about different code.
-  console.log(formatIdentityLine(lisaIdentity()));
+  const identity = lisaIdentity();
+  console.log(formatIdentityLine(identity));
 
   /**
    * Record this run, and refuse to report a verdict we could not record.
@@ -1677,6 +1681,7 @@ function main() {
         runner: parts.runner,
         scripts: parts.scripts ?? null,
         verdict,
+        identity,
       })
     );
     if (written) return code;

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -414,6 +414,9 @@ function statePath() {
   return resolve(git(["rev-parse", "--git-path", "lisa/work-item.json"]));
 }
 
+/** Canonical prefix on a fully qualified local branch ref. */
+const HEADS_PREFIX = "refs/heads/";
+
 function currentBranch() {
   return git(["branch", "--show-current"]);
 }
@@ -431,8 +434,8 @@ function rebaseBranch() {
     );
     if (!existsSync(file)) continue;
     const headName = readFileSync(file, "utf8").trim();
-    if (headName.startsWith("refs/heads/")) {
-      return headName.slice("refs/heads/".length);
+    if (headName.startsWith(HEADS_PREFIX)) {
+      return headName.slice(HEADS_PREFIX.length);
     }
   }
   return "";
@@ -799,7 +802,10 @@ export function deployBranchEnvironments(config) {
       : [];
   const mapped = new Map();
   for (const [environment, branch] of entries) {
-    const name = typeof branch === "string" ? branch.trim() : "";
+    const trimmed = typeof branch === "string" ? branch.trim() : "";
+    const name = trimmed.startsWith(HEADS_PREFIX)
+      ? trimmed.slice(HEADS_PREFIX.length)
+      : trimmed;
     if (name !== "") mapped.set(name, String(environment).trim().toLowerCase());
   }
   if (mapped.size > 0) return mapped;
@@ -2434,9 +2440,6 @@ function parsePushGroups(input, remote) {
   return groups;
 }
 
-/** The `refs/heads/` prefix, spelled once because three parsers below strip it. */
-const HEADS_PREFIX = "refs/heads/";
-
 /**
  * Deploy branches this push must never reach by inheritance.
  *

package/dist/codex/scripts/_extract-edit-paths.sh

@@ -16,6 +16,7 @@
 #   *** Add File: <path>
 #   *** Update File: <path>
 #   *** Delete File: <path>
+#   *** Move to: <path>
 # A single patch may carry MANY files, so callers must loop over the output.
 
 # Print, one per line, every file path the tool envelope intends to write.
@@ -41,6 +42,9 @@ lisa_extract_edit_paths() {
         "*** Add File: "* | "*** Update File: "* | "*** Delete File: "*)
           printf '%s\n' "${line#*File: }"
           ;;
+        "*** Move to: "*)
+          printf '%s\n' "${line#*** Move to: }"
+          ;;
       esac
     done <<<"$patch_text"
   else

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAo9BjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAu3BjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA89BjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAi4BjC,CAAC"}