@codyswann/lisa 4.39.0 → 4.40.1

package/plugins/src/base/hooks/block-no-verify.agy.sh

@@ -961,6 +961,10 @@ def resolve_script(token):
 
 SHELL_COMMAND_STRING = object()
 SHELL_STDIN = object()
+# `-n` / `--noexec`: the shell READS and parses its operand, then exits without
+# executing a line of it. Distinct from the two above because nothing runs at
+# all — there is no payload to scan and no stdin script to wait for.
+SHELL_NOEXEC = object()
 
 
 def shell_execution_operand(args):
@@ -991,12 +995,25 @@ def shell_execution_operand(args):
             index += 1
             continue
         if token.startswith("--"):
+            if token == "--noexec":
+                return SHELL_NOEXEC
             if token not in SHELL_LONG_OPTIONS_NO_VALUE:
                 opaque_option_seen = True
             index += 1
             continue
         if "c" in token[1:]:
             return SHELL_COMMAND_STRING
+        # `-n` is noexec. `bash -n <file>` is the one shape that puts a path at
+        # a command position while provably executing nothing, so it is the
+        # exact seam between reading and running — and reach got it wrong in
+        # BOTH directions (CodySwannGT/lisa#3781). Here it meant a syntax check
+        # of any file merely DISCUSSING the bypass was refused, which is most of
+        # this repository's own guards and every husky hook.
+        #
+        # `bash <file>` still executes and is still refused. Noexec is the
+        # distinction, not the program: this is not a read-only exemption.
+        if "n" in token[1:]:
+            return SHELL_NOEXEC
         index += 1
     return args[index] if index < len(args) else SHELL_STDIN
 
@@ -1041,6 +1058,10 @@ def executed_scripts(tokens):
                     continue
                 if operand is SHELL_COMMAND_STRING:
                     continue
+                if operand is SHELL_NOEXEC:
+                    # Nothing runs, so there is nothing to follow and nothing
+                    # to fail closed about.
+                    continue
             else:
                 continue
             if operand is None:

package/plugins/src/base/hooks/block-no-verify.sh

@@ -24,6 +24,13 @@
 #      `source`, `.`, `bash < nv.sh`, and an interpreter a `find -exec` or
 #      `xargs` puts at a command position.
 #
+# NOT vector 11: `bash -n nv.sh`. `-n` is noexec — the shell reads and parses
+# the file, then exits without running a line — so a syntax check is the one
+# shape that puts a path at a command position while executing nothing. It used
+# to be refused, which made `bash -n` unusable on this file, on every husky
+# hook, and on most of this repository (#3781). The distinction is noexec, not
+# the program: `bash nv.sh` still executes and is still refused.
+#
 # The line below is what lets `lisa apply` tell a downstream copy of this guard
 # that is BEHIND from one that is AHEAD. Byte comparison cannot: both look like
 # "differs from mine", and guessing "behind" is how a fork's stronger guard gets
@@ -1031,6 +1038,10 @@ def resolve_script(token):
 
 SHELL_COMMAND_STRING = object()
 SHELL_STDIN = object()
+# `-n` / `--noexec`: the shell READS and parses its operand, then exits without
+# executing a line of it. Distinct from the two above because nothing runs at
+# all — there is no payload to scan and no stdin script to wait for.
+SHELL_NOEXEC = object()
 
 
 def shell_execution_operand(args):
@@ -1061,12 +1072,25 @@ def shell_execution_operand(args):
             index += 1
             continue
         if token.startswith("--"):
+            if token == "--noexec":
+                return SHELL_NOEXEC
             if token not in SHELL_LONG_OPTIONS_NO_VALUE:
                 opaque_option_seen = True
             index += 1
             continue
         if "c" in token[1:]:
             return SHELL_COMMAND_STRING
+        # `-n` is noexec. `bash -n <file>` is the one shape that puts a path at
+        # a command position while provably executing nothing, so it is the
+        # exact seam between reading and running — and reach got it wrong in
+        # BOTH directions (CodySwannGT/lisa#3781). Here it meant a syntax check
+        # of any file merely DISCUSSING the bypass was refused, which is most of
+        # this repository's own guards and every husky hook.
+        #
+        # `bash <file>` still executes and is still refused. Noexec is the
+        # distinction, not the program: this is not a read-only exemption.
+        if "n" in token[1:]:
+            return SHELL_NOEXEC
         index += 1
     return args[index] if index < len(args) else SHELL_STDIN
 
@@ -1111,6 +1135,10 @@ def executed_scripts(tokens):
                     continue
                 if operand is SHELL_COMMAND_STRING:
                     continue
+                if operand is SHELL_NOEXEC:
+                    # Nothing runs, so there is nothing to follow and nothing
+                    # to fail closed about.
+                    continue
             else:
                 continue
             if operand is None:

package/rails/copy-contents/scripts/lisa-mutation.sh

@@ -70,11 +70,18 @@ if [ -z "$BASE" ]; then
   exit 0
 fi
 
-CHANGED="$(git diff --name-only --diff-filter=ACMR "${BASE}...HEAD" -- 'app/**/*.rb' 'lib/**/*.rb' || true)"
+# Working tree, not "${BASE}...HEAD": mutant reads the files on disk, so a
+# subject whose only change is uncommitted is invisible to committed state and
+# this pre-check would report "nothing to mutate" while a changed subject sat
+# right there. Parity with the TypeScript gate's selectChangedTargets.
+CHANGED="$(git diff --name-only --diff-filter=ACMR "${BASE}" -- 'app/**/*.rb' 'lib/**/*.rb' || true)"
 if [ -z "$CHANGED" ]; then
   echo "⚪ Mutation gate: no changed Ruby files under app/ or lib/ vs ${SINCE}. Nothing to mutate."
   exit 0
 fi
 
+# Known gap, deliberately not papered over: mutant's own --since scoping is
+# committed-based, so the working-tree correction above reaches the pre-check
+# but not mutant's subject selection. There is no mutant flag for it.
 echo "🧬 Mutation gate: running mutant (--since ${SINCE}) on changed subjects..."
 exec bundle exec mutant run --since "$SINCE"

package/scripts/two-channel-couplings.json

@@ -7,7 +7,7 @@
     "workflows": 22,
     "steps": 716,
     "couplings": 34,
-    "inventory": 73
+    "inventory": 74
   },
   "counts": {
     "package-backed": 10,

package/typescript/copy-contents/.husky/pre-commit

@@ -107,6 +107,46 @@ if [ -f ".lintstagedrc.json" ]; then
   fi
 fi
 
+# ---------------------------------------------------------------------------
+# Cross-worktree staged-blob guard.
+#
+# Refuses a commit that stages a NEW file byte-identical to uncommitted work
+# sitting in a different linked worktree. Where several agents share one
+# repository through worktrees, one agent's in-progress file can be committed
+# by another: the file is real, the branch is real, the commit succeeds and
+# every other gate passes, so nothing reports it. Confirmed once — a 284-line
+# test file staged in one worktree, committed an hour later from elsewhere,
+# byte-identical, under a reworded subject.
+#
+# HERE RATHER THAN IN THE GATE REGISTRY, deliberately. This is a property of
+# the machine — which other worktrees exist and what is sitting in them —
+# not of the project, so there is no task a project could declare to prove it.
+# It also has to run on EVERY commit: the whole failure mode is that nobody
+# notices, so a check that waits to be invoked is a check that was not running
+# on the commit where it mattered.
+#
+# Fails OPEN when the script is missing, unlike the lint-staged preflight
+# above. That preflight guards a tool that reports success for work it did not
+# do, so skipping it cannot be read as a pass. This one only ever adds a
+# refusal — a repository without it is exactly as safe as it was before the
+# guard existed, and blocking every commit in a project that has not yet
+# re-applied templates would be a worse trade than the window it closes.
+# ---------------------------------------------------------------------------
+CROSS_WORKTREE_GUARD="node_modules/@codyswann/lisa/all/copy-overwrite/scripts/lisa-cross-worktree-guard.mjs"
+if [ ! -f "$CROSS_WORKTREE_GUARD" ]; then
+  CROSS_WORKTREE_GUARD="scripts/lisa-cross-worktree-guard.mjs"
+fi
+if [ ! -f "$CROSS_WORKTREE_GUARD" ]; then
+  CROSS_WORKTREE_GUARD="all/copy-overwrite/scripts/lisa-cross-worktree-guard.mjs"
+fi
+if [ -f "$CROSS_WORKTREE_GUARD" ] && command -v node >/dev/null 2>&1; then
+  node "$CROSS_WORKTREE_GUARD"
+  CROSS_WORKTREE_GUARD_STATUS=$?
+  if [ $CROSS_WORKTREE_GUARD_STATUS -ne 0 ]; then
+    exit $CROSS_WORKTREE_GUARD_STATUS
+  fi
+fi
+
 # ---------------------------------------------------------------------------
 # Gate-driven checks.
 #

package/typescript/copy-overwrite/.prettierignore

@@ -80,6 +80,7 @@ scripts/check-verification-coverage.mjs
 scripts/classify-maestro-failures.mjs
 scripts/lisa-command-envelope.mjs
 scripts/lisa-commit-msg-gates.mjs
+scripts/lisa-cross-worktree-guard.mjs
 scripts/lisa-destructive-guard.mjs
 scripts/lisa-environment-prepare.mjs
 scripts/lisa-floor-collisions.mjs

package/typescript/copy-overwrite/scripts/lisa-mutation.mjs

@@ -1388,6 +1388,15 @@ export const parseChangedLineRanges = patch => {
 
 /**
  * Stryker mutation ranges for one changed file.
+ *
+ * The diff runs against the WORKING TREE, not `base...HEAD`. Stryker mutates
+ * the files on disk, so a window derived from committed state describes lines
+ * that may no longer be where it says they are: any uncommitted edit above the
+ * change shifts the numbering out from under the window, and the run then
+ * mutates whatever now occupies those lines — measured once as 37 lines of pure
+ * comment, scored, and reported as a verdict about the change. It could as
+ * easily have produced a pass. Diffing what Stryker actually reads is what
+ * makes the window and the subject the same thing.
  * @param {string} cwd - Project root.
  * @param {string} base - Merge-base sha.
  * @param {string} file - Repository-relative path.
@@ -1395,14 +1404,7 @@ export const parseChangedLineRanges = patch => {
  */
 export const selectChangedLineRanges = (cwd, base, file) =>
   parseChangedLineRanges(
-    git(cwd, [
-      "diff",
-      "--unified=0",
-      "--diff-filter=ACMR",
-      `${base}...HEAD`,
-      "--",
-      file,
-    ])
+    git(cwd, ["diff", "--unified=0", "--diff-filter=ACMR", base, "--", file])
   ).map(({ start, end }) => `${file}:${start}-${end}`);
 
 /**
@@ -1416,12 +1418,11 @@ export const selectChangedLineRanges = (cwd, base, file) =>
  *   files no mutation tool here reaches.
  */
 export const selectChangedTargets = (cwd, base, patterns) => {
-  const changed = git(cwd, [
-    "diff",
-    "--name-only",
-    "--diff-filter=ACMRD",
-    `${base}...HEAD`,
-  ])
+  // Working tree, not `base...HEAD`, for the same reason the line ranges are:
+  // a target whose only change is uncommitted is invisible to committed state,
+  // so the gate printed "0 mutate targets" and exited 0 while Stryker, pointed
+  // at the same tree, had a changed target in front of it.
+  const changed = git(cwd, ["diff", "--name-only", "--diff-filter=ACMRD", base])
     .split("\n")
     .map(file => file.trim())
     .filter(Boolean);
@@ -2115,6 +2116,11 @@ export const reportRun = (cwd, result) => {
 export const runGate = (cwd = process.cwd(), argv = []) => {
   const gate = readGate(cwd);
   const enabled = envFlag("MUTATION_ENABLED") ?? gate.enabled === true;
+  // Reads like the LOCAL branch and is not: `resolveDiffBase` probes
+  // `origin/<since>` first and only falls back to the local name, so a stale
+  // local `main` does not drag every commit it is missing into the diff. Said
+  // here because the line alone has already been read the other way and filed
+  // as a defect; the behaviour is pinned by a test rather than by this note.
   const since = process.env.MUTATION_SINCE || gate.since || "main";
 
   if (!enabled) {