@codyswann/lisa 4.4.0 → 4.4.2

package/scripts/check-workflow-package-paths.mjs

@@ -77,7 +77,6 @@
  *
  * @module scripts/check-workflow-package-paths
  */
-import { execFileSync } from "node:child_process";
 import {
   existsSync,
   mkdirSync,
@@ -89,6 +88,7 @@ import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
+import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 /** The package whose released layout a workflow may make claims about. */
@@ -179,7 +179,7 @@ function parseArgs(argv) {
  * @returns {readonly string[]} Repo-relative workflow paths
  */
 function trackedWorkflows(root) {
-  const output = execFileSync(
+  const output = boundedExecFileSync(
     "git",
     ["-C", root, "ls-files", ".github/workflows"],
     { encoding: "utf8" }
@@ -285,7 +285,7 @@ export function collectClaims(root) {
  */
 function publishedVersions() {
   const versions = JSON.parse(
-    execFileSync("npm", ["view", PACKAGE_NAME, "versions", "--json"], {
+    boundedExecFileSync("npm", ["view", PACKAGE_NAME, "versions", "--json"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       maxBuffer: 16 * 1024 * 1024,
@@ -357,7 +357,7 @@ function fetchReleaseListings(chosen, cacheDir) {
       continue;
     }
     const staging = mkdtempSync(path.join(tmpdir(), "lisa-release-"));
-    execFileSync(
+    boundedExecFileSync(
       "npm",
       ["pack", `${PACKAGE_NAME}@${version}`, "--pack-destination", staging],
       { stdio: ["ignore", "pipe", "pipe"] }
@@ -366,10 +366,14 @@ function fetchReleaseListings(chosen, cacheDir) {
     if (tarball === undefined) {
       throw new Error(`npm pack produced no tarball for ${version}`);
     }
-    const entries = execFileSync("tar", ["-tzf", path.join(staging, tarball)], {
-      encoding: "utf8",
-      maxBuffer: 64 * 1024 * 1024,
-    })
+    const entries = boundedExecFileSync(
+      "tar",
+      ["-tzf", path.join(staging, tarball)],
+      {
+        encoding: "utf8",
+        maxBuffer: 64 * 1024 * 1024,
+      }
+    )
       .split("\n")
       .filter(Boolean);
     listings[version] = entries;

package/scripts/generate-lisa-owned-hash-ledger.mjs

@@ -19,11 +19,12 @@
  *   legitimately stale file as host-modified and stop refreshing it — failing
  *   safe, but permanently.
  */
-import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 
+import { boundedExecFileSync, isChildTimeout } from "./lib/bounded-spawn.mjs";
+
 const repoRoot = path.resolve(import.meta.dirname, "..");
 const outputPath = path.join(repoRoot, "src/core/lisa-owned-hash-ledger.ts");
 const COPY_OVERWRITE = "copy-overwrite";
@@ -35,18 +36,25 @@ const ENFORCEMENT_TREE = "scripts/";
  *
  * Blobs are read as `binary` so arbitrary bytes survive the round trip into the
  * Buffer that gets hashed; decoding as UTF-8 would corrupt any non-text file.
+ * A KILLED child re-raises. Every caller reads this as content, and an empty
+ * string is a perfectly well-formed answer meaning "no files" — so a timeout
+ * on the `ls-files` call would build a ledger that vouches for NOTHING and
+ * report it as a complete one. A ledger's whole job is to vouch for bytes; one
+ * assembled from silence is worse than none, because it looks authoritative.
  * @param {readonly string[]} args - Arguments passed to git
- * @returns {string} Command stdout, or an empty string when git fails
+ * @returns {string} Command stdout, or an empty string when git said nothing
+ * @throws {Error} When the child was killed at its deadline
  */
 function git(args) {
   try {
-    return execFileSync("git", args, {
+    return boundedExecFileSync("git", args, {
       cwd: repoRoot,
       encoding: "buffer",
       maxBuffer: 64 * 1024 * 1024,
       stdio: ["ignore", "pipe", "ignore"],
     }).toString("binary");
-  } catch {
+  } catch (error) {
+    if (isChildTimeout(error)) throw error;
     return "";
   }
 }

package/scripts/generate-upstream-evidence-manifest.mjs

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 /** Generate the exact hash-pinned allowlist for public upstream evidence. */
-import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 
+import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
 import {
   describeStaleManifest,
   diagnoseStaleManifest,
@@ -86,7 +86,7 @@ function repositoryPath(url) {
 // comparison is by path: `url.<base>.insteadOf` rewrites what `git remote
 // get-url` returns, so it answers "how do I reach this" rather than "what is
 // this". Falls back to the resolved URL only if no value is configured.
-const originUrl = execFileSync(
+const originUrl = boundedExecFileSync(
   "git",
   ["config", "--get", "remote.origin.url"],
   { cwd: repoRoot, encoding: "utf8" }
@@ -100,7 +100,7 @@ if (repositoryPath(originUrl) !== canonicalRepository.toLowerCase()) {
   );
 }
 
-const tracked = execFileSync("git", ["ls-files", "-z"], {
+const tracked = boundedExecFileSync("git", ["ls-files", "-z"], {
   cwd: repoRoot,
   encoding: "utf8",
 })
@@ -135,7 +135,7 @@ const existingPublicCommits = [
   .filter(Boolean);
 const refreshPublicCommits = process.argv.includes("--refresh-public-commits");
 const discoveredPublicCommits = refreshPublicCommits
-  ? execFileSync("git", ["rev-list", "--remotes=origin"], {
+  ? boundedExecFileSync("git", ["rev-list", "--remotes=origin"], {
       cwd: repoRoot,
       encoding: "utf8",
     })

package/scripts/verify-health-agentic-built.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 /** Empirical proof for the shipped optional agentic Health composition API. */
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import {
   lstat,
@@ -17,6 +16,8 @@ import {
 import { tmpdir } from "node:os";
 import path from "node:path";
 
+import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
+
 // Literals named once — each was repeated enough times that a typo in one
 // copy would diverge silently.
 const TEMPLATES_MANAGED = "templates.managed";
@@ -62,14 +63,14 @@ const root = process.cwd();
 const workspace = await mkdtemp(path.join(tmpdir(), "lisa-health-agentic-"));
 const project = path.join(workspace, "host");
 const isolatedBin = path.join(workspace, "bin");
-const gitExecutable = execFileSync("which", ["git"], {
+const gitExecutable = boundedExecFileSync("which", ["git"], {
   encoding: "utf8",
 }).trim();
 const healthFile = path.join(project, ".lisa", "health", "latest.json");
 const startedAt = Date.now();
 
 const run = (executable, argv, options = {}) =>
-  execFileSync(executable, argv, {
+  boundedExecFileSync(executable, argv, {
     cwd: project,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],

package/scripts/verify-health-consumer-built.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 /** Built-package proof for the real two-phase Health CLI consumer. */
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
 import {
   lstat,
   mkdir,
@@ -14,6 +13,8 @@ import {
 import { tmpdir } from "node:os";
 import path from "node:path";
 
+import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
+
 // Literals named once — each was repeated enough times that a typo in one
 // copy would diverge silently.
 const LATEST_JSON = "latest.json";
@@ -53,7 +54,7 @@ async function createProject(name) {
 
 /** Run the compiled CLI and capture its exact standard-output bytes. */
 function runCli(project, argv, input) {
-  return execFileSync(
+  return boundedExecFileSync(
     process.execPath,
     [cli, "--no-update-check", "health", ...argv, project],
     {

package/scripts/verify-health-contract-built.mjs

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 /** Empirical proof for the shipped Health v1 contract and real built CLI. */
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
+import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
+
 let assertions = 0;
 const check = (condition, message) => {
   assertions += 1;
@@ -23,7 +24,7 @@ try {
     path.join(project, ".lisa.config.json"),
     `${JSON.stringify({ tracker: "github", github: { org: "acme", repo: "app" } }, null, 2)}\n`
   );
-  execFileSync(
+  boundedExecFileSync(
     process.execPath,
     [path.join(root, "dist/index.js"), "sync", project, "--json"],
     {

package/scripts/verify-health-deterministic-built.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 /** Empirical proof for the shipped deterministic Health fast path. */
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import {
   chmod,
@@ -18,6 +17,8 @@ import {
 import { tmpdir } from "node:os";
 import path from "node:path";
 
+import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
+
 // Literals named once — each was repeated enough times that a typo in one
 // copy would diverge silently.
 const PACKAGE_JSON = "package.json";
@@ -40,14 +41,14 @@ const root = process.cwd();
 const workspace = await mkdtemp(path.join(tmpdir(), "lisa-health-fast-path-"));
 const project = path.join(workspace, "host");
 const isolatedBin = path.join(workspace, "bin");
-const gitExecutable = execFileSync("which", ["git"], {
+const gitExecutable = boundedExecFileSync("which", ["git"], {
   encoding: "utf8",
 }).trim();
 const healthFile = path.join(project, ".lisa", "health", "latest.json");
 const startedAt = Date.now();
 
 const run = (executable, argv, options = {}) =>
-  execFileSync(executable, argv, {
+  boundedExecFileSync(executable, argv, {
     cwd: project,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
@@ -466,7 +467,7 @@ try {
       path.join(unsafeProject, LISA_CONFIG_JSON),
       '{"tracker":"github","harness":"codex"}\n'
     );
-    execFileSync("mkfifo", [path.join(unsafeProject, PACKAGE_JSON)]);
+    boundedExecFileSync("mkfifo", [path.join(unsafeProject, PACKAGE_JSON)]);
     const unsafeStarted = Date.now();
     const unsafe = await health.runDeterministicHealth(unsafeProject, {
       lisaRoot: root,