@codyswann/lisa 4.35.2 → 4.35.4

package/plugins/src/base/hooks/block-host-name-leak.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# PreToolUse hook for Bash: refuse an outbound tracker write that names a host
+# project.
+#
+# The classification lives in block-host-name-leak.mjs beside this file, because
+# the detector it must consult is compiled JavaScript (`dist/core/`) and calling
+# it from Node is the only way to keep ONE denylist. A bash reimplementation of
+# the matcher would be a second copy of the thing the guard exists to protect,
+# and copies drift.
+#
+# This wrapper does three things and nothing else: probe its interpreters,
+# unwrap the Claude hook envelope, and hand the command string to Node.
+#
+# FAILING OPEN, LOUDLY
+#
+# Claude Code treats exit 2 as a refusal and every OTHER non-zero exit as a
+# non-blocking hook error — meaning the command runs. Under `set -euo pipefail`
+# an absent jq exits 127, so an unguarded probe would permit exactly what this
+# exists to stop. Degrading to "allow" is correct: a hook that cannot read its
+# input cannot tell a tracker write from a directory listing, and failing closed
+# would block every Bash call on a machine missing an interpreter. Announcing it
+# is mandatory, because a guard that is silently absent reads exactly like a
+# guard that is passing. Same reasoning as block-direct-issue-create.sh.
+set -euo pipefail
+
+input="$(cat)"
+
+for required in jq node; do
+  if ! command -v "$required" >/dev/null 2>&1; then
+    printf 'block-host-name-leak: %s not found; host-identity enforcement is NOT active\n' \
+      "$required" >&2
+    exit 0
+  fi
+done
+
+tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null || true)"
+if [ "$tool_name" != "Bash" ]; then
+  exit 0
+fi
+
+command_str="$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || true)"
+if [ -z "$command_str" ]; then
+  exit 0
+fi
+
+project_dir="${CLAUDE_PROJECT_DIR:-}"
+if [ -z "$project_dir" ]; then
+  project_dir="$PWD"
+fi
+
+hook_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+classifier="$hook_dir/block-host-name-leak.mjs"
+if [ ! -r "$classifier" ]; then
+  printf 'block-host-name-leak: classifier missing at %s; host-identity enforcement is NOT active\n' \
+    "$classifier" >&2
+  exit 0
+fi
+
+status=0
+node "$classifier" "$command_str" "$project_dir" || status=$?
+exit "$status"

package/scripts/downstream-name-digest.mjs

@@ -0,0 +1,128 @@
+#!/usr/bin/env node
+/**
+ * Turn a host name into the denylist entry that represents it, without ever
+ * writing the name down.
+ *
+ * WHY THIS EXISTS
+ *
+ * `HOST_NAME_ENTRIES` in `src/core/downstream-names.ts` holds truncated salted
+ * digests precisely so the list cannot be read out of a public repository. That
+ * is the right design and it has one cost: **adding an entry requires computing
+ * a digest, and there was no way to do it.** Three names known to be missing —
+ * a legal-entity org slug whose short product form is present, an organisation
+ * whose tracker-site slug differs from its repo-host org slug, and organisation
+ * email domains — have stayed missing for that reason rather than any other. A
+ * gap nobody can close in one step stays open.
+ *
+ * WHAT IT DELIBERATELY DOES NOT DO
+ *
+ * It does not write to `downstream-names.ts`, and it does not accept a file of
+ * names. Both would put plaintext identities on disk in a repository whose
+ * entire point here is that they are not on disk. It prints entries to stdout;
+ * a person pastes them in. The name reaches the terminal and nowhere else.
+ *
+ * Prefer shell history hygiene when running it: on most shells a leading space
+ * keeps the command out of the history file.
+ *
+ * USAGE
+ *
+ *   node scripts/downstream-name-digest.mjs "Some Host" somehost.example
+ *   printf 'one\ntwo\n' | node scripts/downstream-name-digest.mjs
+ *
+ * Each line of output is one array element for `HOST_NAME_ENTRIES`, already
+ * quoted and comma-terminated, sorted the way the existing list is.
+ * @module scripts/downstream-name-digest
+ */
+import { createHash } from "node:crypto";
+
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
+
+/**
+ * Domain separator, duplicated from `src/core/downstream-names.ts`.
+ *
+ * A second copy is the wrong shape in general, and it is the right one here:
+ * this script must run with no build step and no import of compiled output,
+ * because the person adding a name should not have to build the repository
+ * first. The duplication is guarded — `downstream-name-digest.test.ts` asserts
+ * this script's output equals `nameEntry()` for the same input, so a change to
+ * the salt or the truncation on either side fails immediately rather than
+ * silently producing entries that never match.
+ */
+const DIGEST_SALT = "lisa/downstream-name/v1";
+/** Hex characters kept from each digest — 40 bits. Mirrors the module. */
+const DIGEST_HEX_LENGTH = 10;
+/** Shortest name worth listing. Mirrors the module. */
+const MIN_NAME_LENGTH = 5;
+
+/**
+ * Reduce a name to the alphanumerics the matcher compares.
+ * @param raw - The name as a person writes it.
+ * @returns Lowercased alphanumerics only.
+ */
+export function normalize(raw) {
+  return raw.toLowerCase().replaceAll(/[^a-z0-9]+/gu, "");
+}
+
+/**
+ * The `length:digest` entry for one name.
+ * @param raw - The name as a person writes it.
+ * @returns The entry, or undefined when the name is too short to list.
+ */
+export function entryFor(raw) {
+  const normalized = normalize(raw);
+  if (normalized.length < MIN_NAME_LENGTH) return undefined;
+  const digest = createHash("sha256")
+    .update(DIGEST_SALT)
+    .update(normalized)
+    .digest("hex")
+    .slice(0, DIGEST_HEX_LENGTH);
+  return `${normalized.length}:${digest}`;
+}
+
+/**
+ * Read names from argv, or from stdin when argv carries none.
+ * @returns The raw names.
+ */
+async function readNames() {
+  const fromArgs = process.argv.slice(2).filter(name => name !== "");
+  if (fromArgs.length > 0) return fromArgs;
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return chunks
+    .join("")
+    .split("\n")
+    .map(line => line.trim())
+    .filter(line => line !== "");
+}
+
+/** Print one entry per accepted name, and name the rejects on stderr. */
+async function main() {
+  const names = await readNames();
+  if (names.length === 0) {
+    process.stderr.write(
+      "usage: node scripts/downstream-name-digest.mjs <name> [name...]\n"
+    );
+    process.exit(1);
+  }
+  const entries = names.map(name => ({ name, entry: entryFor(name) }));
+  for (const rejected of entries.filter(pair => pair.entry === undefined)) {
+    process.stderr.write(
+      `skipped: a name shorter than ${MIN_NAME_LENGTH} characters after normalization would collide with ordinary words (${rejected.name.length} given)\n`
+    );
+  }
+  const accepted = [
+    ...new Set(
+      entries
+        .filter(pair => pair.entry !== undefined)
+        .map(pair => `${pair.entry}`)
+    ),
+  ].sort();
+  for (const entry of accepted) process.stdout.write(`  "${entry}",\n`);
+  process.stderr.write(
+    `\nPaste the ${accepted.length} line(s) above into HOST_NAME_ENTRIES in src/core/downstream-names.ts, keeping the array sorted.\nThe names themselves were not written anywhere.\n`
+  );
+}
+
+if (invokedAsScript(import.meta.url)) {
+  await main();
+}

package/scripts/generate-agy-plugin-artifacts.mjs

@@ -261,6 +261,18 @@ const AGY_PLUGIN_HOOKS = [
     agyScript: "block-direct-issue-create.agy.sh",
     supportScripts: ["block-direct-issue-create.sh"],
   },
+  {
+    // Same shape as the entry above, plus one support file the others do not
+    // need: the classifier is Node, because the denylist it consults is
+    // compiled JavaScript and a bash reimplementation would be a second copy of
+    // the thing the guard exists to protect.
+    sourceScript: "block-host-name-leak.sh",
+    hookName: "lisa-block-host-name-leak",
+    event: "PreToolUse",
+    matcher: "run_command",
+    agyScript: "block-host-name-leak.agy.sh",
+    supportScripts: ["block-host-name-leak.sh", "block-host-name-leak.mjs"],
+  },
 ];
 
 /**

package/scripts/reconcile-release-tags.mjs

@@ -0,0 +1,331 @@
+#!/usr/bin/env node
+/**
+ * Which version tags correspond to a release that actually reached the registry (issue #3751).
+ *
+ * A tag is the artifact people trust when they ask "which version is live?",
+ * precisely because it looks authoritative. This repository pushes the tag
+ * BEFORE the step that makes a release a release for a consumer, so a tag can
+ * outlive the failure of the thing it asserts:
+ *
+ *   deploy.yml
+ *     release  (release.yml)
+ *       version             computes the version
+ *       release_signing     git tag -s + git push refs/tags/...   <- TAG PUSHED
+ *       release_attestation
+ *       github_release      GitHub Release created
+ *     publish_npm  needs:[release]  (publish-to-npm.yml)
+ *       npm publish ...                                           <- PUBLISH, AFTER
+ *
+ * `npm publish` runs in a separate downstream job, so the attestation, the
+ * GitHub Release and the whole publish job all happen after the tag exists.
+ *
+ * THE ORDERING IS DELIBERATE AND THIS SCRIPT DOES NOT CHANGE IT. Tagging early
+ * is what lets a re-run see "this version was already cut" and resume instead
+ * of duplicating. Moving the tag to the end would trade that away, and the
+ * alternatives are each worse: deleting a pushed tag is its own hazard once a
+ * consumer may have fetched it, and "tag early, mark incomplete" needs a place
+ * to record incompleteness that does not exist. So the tag stays where it is
+ * and this reconciles the residue instead.
+ *
+ * ## Three verdicts, because two would be a licence to do harm
+ *
+ * The verdicts are `published`, `missing` and `unprovable`, and the third is
+ * the load-bearing one. Retracting or flagging a GOOD release because the
+ * registry was briefly unreachable is the one direction this work can do harm,
+ * so anything that is not a definitive 404 on the exact-version endpoint is
+ * `unprovable` — a rate limit, a 5xx, a DNS failure, an auth error and a
+ * timeout are all "ask again later", never "this release did not happen".
+ *
+ * Note the asymmetry that makes this safe: `published` and `missing` are
+ * claims about the registry, while `unprovable` is a claim about THIS RUN.
+ *
+ * ## Bounded false positives (explicit acceptance criterion)
+ *
+ * A reconciliation that flags everything is as useless as one that flags
+ * nothing, and it looks far more diligent while doing it. The first draft of
+ * this scan reported 765 releases as untagged; every one was a false positive
+ * caused by reading only ONE of this repository's two tag conventions.
+ *
+ *   - Two conventions are recognised: the current `v1.2.3` and the earlier
+ *     `vv1.2.3`. Reading only the first misclassifies 765 correctly-tagged
+ *     releases as untagged and hides 13 genuine orphans. This is the single
+ *     highest-value line in the file and is pinned by a regression test.
+ *   - Non-version refs (`backup/...`, `_fleet/...`, `pr-assets`) are not
+ *     release tags and are never rows.
+ *   - A prerelease or build-metadata suffix is not a plain release tag and is
+ *     not reconciled here rather than being guessed at.
+ *   - The tag list is the input; a version published with no tag at all is
+ *     reported separately, because it is a different defect from a tag with no
+ *     publication and conflating them produces a number nobody can act on.
+ *
+ * ## What this deliberately does NOT read
+ *
+ * It does not read workflow run history. That axis belongs to the release-time
+ * reconciliation (#3684), and it carries a trap worth recording here so the
+ * next reader does not walk into it: the default
+ * `GET /actions/runs/<id>/jobs` endpoint returns jobs for the LATEST ATTEMPT
+ * only. A run whose failed job was re-run, where the re-run was then cancelled,
+ * truthfully reports `{"total_count": 0, "jobs": []}` while holding its real
+ * jobs one attempt down, and `gh run view <id> --log` exits 0 printing nothing.
+ * A sweep built on those defaults would read a KNOWN failed release as having
+ * no evidence and return `unprovable` — the verdict that means "do not act".
+ * Use `attempts/<n>/jobs` or `?filter=all`.
+ *
+ * @module scripts/reconcile-release-tags
+ */
+
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
+
+/**
+ * The verdicts, shared with the release-time reconciliation.
+ *
+ * One vocabulary for one concept: a second set of strings for the same three
+ * states is how two tickets about one incident start disagreeing in reports
+ * that are supposed to be compared.
+ */
+export const VERDICT = Object.freeze({
+  PUBLISHED: "published",
+  MISSING: "missing",
+  UNPROVABLE: "unprovable",
+});
+
+/**
+ * Both tag conventions this repository has used, current first.
+ *
+ * `vv1.2.3` is not a typo — it is what the early release process produced, and
+ * 765 releases carry it. A pattern anchored to a single `v` silently reads
+ * every one of them as untagged.
+ */
+const VERSION_TAG = /^vv?(\d+\.\d+\.\d+)$/;
+
+/**
+ * The version a release tag names, or null when the ref is not a release tag.
+ * @param {string} tag A git ref name, without `refs/tags/`.
+ * @returns {string|null} The bare `x.y.z` version, or null.
+ */
+export function parseVersionTag(tag) {
+  const matched = VERSION_TAG.exec(String(tag ?? "").trim());
+  return matched ? matched[1] : null;
+}
+
+/**
+ * What a single registry probe establishes.
+ *
+ * Only a definitive 404 on the EXACT-VERSION endpoint proves absence. Every
+ * other outcome — including a 200 that is not the version asked for, an auth
+ * failure, a rate limit and any transport error — establishes nothing about
+ * whether the release happened, and says so rather than guessing.
+ * @param {object} probe The probe result.
+ * @param {number|null} [probe.status] HTTP status, or null when none was received.
+ * @param {string|null} [probe.error] Transport-level failure, if any.
+ * @returns {string} One of the `VERDICT` values.
+ */
+export function classifyProbe({ status = null, error = null } = {}) {
+  if (error) return VERDICT.UNPROVABLE;
+  if (status === 200) return VERDICT.PUBLISHED;
+  if (status === 404) return VERDICT.MISSING;
+  return VERDICT.UNPROVABLE;
+}
+
+/**
+ * Reconcile a tag list against a set of probes.
+ *
+ * Pure: the caller supplies both the refs and a probe function, so the
+ * classification is testable without a network and a fixture can reproduce a
+ * registry outage exactly.
+ * @param {object} options Inputs.
+ * @param {readonly string[]} options.tags Every ref name in the repository.
+ * @param {(version: string) => {status?: number|null, error?: string|null}} options.probe Registry probe.
+ * @returns {{rows: object[], ignored: string[]}} Rows per release tag, and refs that were not release tags.
+ */
+export function reconcile({ tags, probe }) {
+  const rows = [];
+  const ignored = [];
+  for (const tag of tags) {
+    const version = parseVersionTag(tag);
+    if (version === null) {
+      ignored.push(tag);
+      continue;
+    }
+    rows.push({ tag, version, verdict: classifyProbe(probe(version)) });
+  }
+  return { rows, ignored };
+}
+
+/**
+ * The exact-version registry endpoint for one version.
+ *
+ * EXACT VERSION, never `dist-tags.latest`. `latest` lags a successful publish
+ * by minutes, so reconciling against it reports a release that shipped moments
+ * ago as absent — a false `missing` on the newest and most-scrutinised release.
+ * @param {string} pkg The package name.
+ * @param {string} version The exact version.
+ * @returns {string} The URL to probe.
+ */
+export function registryUrl(pkg, version) {
+  return `https://registry.npmjs.org/${pkg.replace("/", "%2f")}/${version}`;
+}
+
+/**
+ * Probe the registry for one version, converting every failure into a shape
+ * `classifyProbe` can read rather than throwing.
+ * @param {string} pkg The package name.
+ * @param {string} version The exact version.
+ * @param {typeof fetch} [fetchImpl] Injected for tests.
+ * @returns {Promise<{status: number|null, error: string|null}>} The probe result.
+ */
+export async function probeRegistry(pkg, version, fetchImpl = fetch) {
+  try {
+    const response = await fetchImpl(registryUrl(pkg, version), {
+      method: "GET",
+    });
+    if (response.status !== 200)
+      return { status: response.status, error: null };
+    // A 200 IS NOT ENOUGH — the body has to name the version that was asked
+    // for. This matches the release-time check (#3684) exactly: a 200 whose
+    // body names something else, or which does not parse, settles nothing and
+    // is `unprovable` rather than `published`. Two surfaces reporting the same
+    // word about one release have to mean the same thing by it, or comparing
+    // their reports is meaningless.
+    let body;
+    try {
+      body = await response.json();
+    } catch (error) {
+      return {
+        status: null,
+        error: `unparseable body: ${String(error?.message ?? error)}`,
+      };
+    }
+    if (body?.version !== version)
+      return {
+        status: null,
+        error: `registry served version ${String(body?.version)} for ${version}`,
+      };
+    return { status: 200, error: null };
+  } catch (error) {
+    // A transport failure is NOT evidence of absence. Returning it as an error
+    // is what makes `classifyProbe` answer `unprovable` instead of `missing`.
+    return { status: null, error: String(error?.message ?? error) };
+  }
+}
+
+/**
+ * Probe a version, retrying ONLY while the answer is `unprovable`.
+ *
+ * A retry loop that also re-ran `missing` would be asking the registry to
+ * change its mind about a definite 404, and one that re-ran `published` would
+ * double the cost of the common case. Only "we could not look" is worth
+ * looking again at.
+ *
+ * This matters at sweep scale rather than for a single release. The first real
+ * run over 1,699 tags produced two `unprovable` rows, and one of them was
+ * `v2.325.4` — a version that IS published, whose probe simply failed in
+ * flight. Without a re-probe every sweep carries a couple of rows an operator
+ * has to chase by hand, which is how a report starts getting skimmed.
+ * @param {string} pkg The package name.
+ * @param {string} version The exact version.
+ * @param {object} [options] Retry controls.
+ * @param {number} [options.attempts] Total attempts, including the first.
+ * @param {() => Promise<void>} [options.pause] Delay between attempts.
+ * @param {typeof fetch} [options.fetchImpl] Injected for tests.
+ * @returns {Promise<{status: number|null, error: string|null}>} The last probe result.
+ */
+export async function probeWithRetry(
+  pkg,
+  version,
+  { attempts = 2, pause = async () => {}, fetchImpl = fetch } = {}
+) {
+  let last = { status: null, error: "not attempted" };
+  for (let attempt = 0; attempt < Math.max(1, attempts); attempt += 1) {
+    if (attempt > 0) await pause();
+    last = await probeRegistry(pkg, version, fetchImpl);
+    if (classifyProbe(last) !== VERDICT.UNPROVABLE) return last;
+  }
+  return last;
+}
+
+/**
+ * The operator-facing report.
+ *
+ * SAYS WHAT THE VERDICTS MEAN, IN THE OUTPUT. A bare count of orphan tags
+ * reads as a count of failed releases, and those are different claims: this
+ * repository has 26 tags with no published version and exactly one of them is
+ * a proven failed release. Someone reading the report in a hurry must not be
+ * able to take the number for an incident count, so the distinction is printed
+ * rather than left in a doc comment nobody opens.
+ * @param {{rows: object[], ignored: string[]}} result As returned by `reconcile`.
+ * @returns {string} The report.
+ */
+export function formatReport({ rows, ignored }) {
+  const of = verdict => rows.filter(row => row.verdict === verdict);
+  const missing = of(VERDICT.MISSING);
+  const unprovable = of(VERDICT.UNPROVABLE);
+  return [
+    "Release-tag reconciliation",
+    "",
+    `  release tags     ${rows.length}`,
+    `  non-release refs ${ignored.length}`,
+    `  published        ${of(VERDICT.PUBLISHED).length}`,
+    `  missing          ${missing.length}`,
+    `  unprovable       ${unprovable.length}`,
+    "",
+    "What the verdicts claim:",
+    "  published  — the exact version answered 200 on the registry.",
+    "  missing    — a claim about THE REGISTRY: the exact version answered 404.",
+    "               It is NOT a claim that a release run failed. A tag can lack",
+    "               a published version because the publish failed, because the",
+    "               version was unpublished inside npm's 72-hour window, or",
+    "               because it predates publishing from this repository.",
+    "               Each one needs its release run read before it is called an",
+    "               incident.",
+    "  unprovable — a claim about THIS RUN: the registry could not be reached,",
+    "               or answered something that settles nothing. Never treat it",
+    "               as absence; run it again.",
+    "",
+    ...(missing.length
+      ? [
+          "Tags with no published version:",
+          ...missing.map(r => `  ${r.tag}`),
+          "",
+        ]
+      : []),
+    ...(unprovable.length
+      ? [
+          "Not established by this run (re-run before drawing any conclusion):",
+          ...unprovable.map(r => `  ${r.tag}`),
+          "",
+        ]
+      : []),
+  ].join("\n");
+}
+
+/**
+ * CLI entry point.
+ */
+async function main() {
+  const pkg = process.env.LISA_RECONCILE_PACKAGE ?? "@codyswann/lisa";
+  const { execFileSync } = await import("node:child_process");
+  const tags = execFileSync("git", ["tag", "--list"], { encoding: "utf8" })
+    .split("\n")
+    .filter(Boolean);
+
+  const probes = new Map();
+  for (const tag of tags) {
+    const version = parseVersionTag(tag);
+    if (version === null || probes.has(version)) continue;
+    probes.set(version, await probeWithRetry(pkg, version));
+  }
+
+  const result = reconcile({
+    tags,
+    probe: version => probes.get(version) ?? {},
+  });
+  console.log(formatReport(result));
+  // Report-only: an orphan tag is a finding for a human to classify, not a
+  // build to fail. Exiting non-zero here would make every consumer of this
+  // script treat 26 historical tags as a red.
+}
+
+if (invokedAsScript(import.meta.url)) {
+  main();
+}