@codyswann/lisa 4.4.3 → 4.4.5

package/rails/copy-overwrite/scripts/check-threshold-ratchet.mjs

@@ -95,6 +95,20 @@ const NO_RENAMES = "--no-renames";
 
 /**
  * Run git, returning stdout or null on any failure.
+ *
+ * The swallow is CORRECT here and is kept, because #2777 already made the
+ * consumer fail closed: a null change set reaches `threshold-ratchet: failing
+ * closed — an enforcement gate that cannot read the change set has not verified
+ * it`. That comment names the original defect exactly — "git() swallows every
+ * failure, so the ratchet passed exactly when it had no evidence" — so a killed
+ * child now joins the failures that already refuse. This call site needed the
+ * DEADLINE and nothing else.
+ *
+ * The deadline is written inline rather than imported. This file is
+ * materialized from `plugins/src/base/hooks/` into two stack lanes AND runs as
+ * an agent-time hook inside a plugin payload, which has no `./lib/` to import
+ * from — the same accommodation `preflight-secrets.mjs` makes, and the same one
+ * the entry guard below is written out for.
  * @param {string[]} args Git arguments
  * @param {string} [cwd] Working directory
  * @returns {string | null} Captured stdout, or null when git failed
@@ -105,6 +119,9 @@ function git(args, cwd) {
       cwd,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"],
+      // A hang detector, not a budget. `git` reached through PATH on macOS goes
+      // via Apple's xcrun shim, measured over 20s under load in #2887.
+      timeout: 30_000,
     });
   } catch {
     return null;

package/scripts/plugin-parity-drift.mjs

@@ -278,12 +278,51 @@ function readManifestVersion(manifestPath) {
   }
 }
 
+/**
+ * Whether a cached version directory has been ORPHANED — the plugin manager's
+ * marker for a version that is no longer installed or served.
+ *
+ * The cache is append-mostly: uninstalling a plugin does not delete its version
+ * directories, it stamps each one with `.orphaned_at`. So the directories on
+ * disk are a record of every version ever fetched, not of what is installed
+ * now, and reading them as the latter is how this script came to compare a pin
+ * against ten-day-old leftovers.
+ *
+ * @param {string} versionDir - absolute path to one cached version directory.
+ * @returns {boolean} true when the directory carries an orphan marker.
+ */
+function isOrphanedVersion(versionDir) {
+  return fs.existsSync(path.join(versionDir, ".orphaned_at"));
+}
+
 /**
  * Resolve the current upstream version of `name@marketplace` purely from the
- * cache tree: the MAX valid semver across the immediate version subdirs, read
- * from each subdir's `.claude-plugin/plugin.json` `version` field. Non-semver
- * dirs (`unknown`, git hashes) are skipped because the manifest version is what
- * counts.
+ * cache tree: the MAX valid semver across the immediate version subdirs that
+ * are still LIVE, read from each subdir's `.claude-plugin/plugin.json`
+ * `version` field. Non-semver dirs (`unknown`, git hashes) are skipped because
+ * the manifest version is what counts, and orphaned dirs are skipped because
+ * they are not installed.
+ *
+ * Orphans are filtered BEFORE the max, and the order is load-bearing.
+ * "Filter, then take the max" and "take the max, then check whether it is
+ * orphaned" are different functions, and they disagree exactly when the newest
+ * live version is older than an orphan:
+ *
+ *     live 1.0.6  +  orphaned 2.0.4
+ *       filter-then-max  -> 1.0.6          (correct: 1.0.6 IS installed)
+ *       max-then-check   -> not-installed  (wrong)
+ *
+ * When nothing live remains, this reports `not-installed` — a status this
+ * script already has and already handles — rather than manufacturing a current
+ * version out of orphans. That is `core/apply-receipt`'s principle: an
+ * unresolvable state reports unresolvable, not half-understood.
+ *
+ * The failure this closes was not theoretical. Every one of the ten cached
+ * `safety-net` versions was orphaned in a single sweep, and the resulting
+ * manufactured comparison blocked every push from the checkout — in one
+ * direction, and then, after a pin was moved to satisfy it, in the other.
+ * A defect that produces two opposite plausible remedies is one where the
+ * remedy is in neither direction.
  *
  * @param {string} cacheRoot - the installed-plugin cache root.
  * @param {string} name - plugin name.
@@ -304,23 +343,39 @@ export function resolveCurrentVersion(cacheRoot, name, marketplace) {
     return { status: NOT_INSTALLED, version: null };
   }
   const versions = [];
+  // Counted separately from `versions`, because "nothing is installed" and
+  // "something is installed but I cannot read its version" are different
+  // answers and must not collapse into one. A live directory with an
+  // unparseable manifest is `unresolved`; no live directory at all is
+  // `not-installed`.
+  let liveDirs = 0;
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
     if (!entry.isDirectory()) {
       continue;
     }
-    const manifest = path.join(
-      dir,
-      entry.name,
-      ".claude-plugin",
-      "plugin.json"
-    );
+    const versionDir = path.join(dir, entry.name);
+    // Before the manifest is even read: an orphaned directory is not an
+    // installed version, whatever its manifest claims.
+    if (isOrphanedVersion(versionDir)) {
+      continue;
+    }
+    liveDirs += 1;
+    const manifest = path.join(versionDir, ".claude-plugin", "plugin.json");
     const version = readManifestVersion(manifest);
     if (version !== null && isValidSemver(version)) {
       versions.push(version);
     }
   }
   if (versions.length === 0) {
-    return { status: "unresolved", version: null };
+    // No live directory at all means the plugin is not installed — a known,
+    // answerable state, and the one the whole orphan filter exists to reach.
+    // But a live directory whose manifest would not parse is still INSTALLED
+    // and merely unreadable, which is what `unresolved` has always meant.
+    // Collapsing the two would answer "I cannot read this version" with "this
+    // is not here", and an operator would go looking for the wrong thing.
+    return liveDirs === 0
+      ? { status: NOT_INSTALLED, version: null }
+      : { status: "unresolved", version: null };
   }
   // `versions` is non-empty (guarded above), so seeding with the first element
   // is exactly what the no-seed form did — and it cannot throw if that guard is

package/typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs

@@ -195,10 +195,10 @@
  * @module scripts/check-skipped-required-checks
  */
 
-import { execFileSync } from "node:child_process";
 import { appendFileSync, existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
+import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 /** Repo-relative path of the per-repo declaration file. */
@@ -988,7 +988,7 @@ export function fetchPullRequestChecks(pr, repo) {
   if (repo) args.push("--repo", repo);
   let raw;
   try {
-    raw = execFileSync("gh", args, { encoding: "utf8" });
+    raw = boundedExecFileSync("gh", args, { encoding: "utf8" });
   } catch (error) {
     raw = typeof error?.stdout === "string" ? error.stdout : "";
     if (raw.trim() === "") {
@@ -1027,7 +1027,7 @@ export function fetchLiveRequiredContexts(ruleset) {
   }
   const contexts = [];
   for (const id of ruleset.ids) {
-    const raw = execFileSync(
+    const raw = boundedExecFileSync(
       "gh",
       [
         "api",

package/typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs

@@ -95,6 +95,20 @@ const NO_RENAMES = "--no-renames";
 
 /**
  * Run git, returning stdout or null on any failure.
+ *
+ * The swallow is CORRECT here and is kept, because #2777 already made the
+ * consumer fail closed: a null change set reaches `threshold-ratchet: failing
+ * closed — an enforcement gate that cannot read the change set has not verified
+ * it`. That comment names the original defect exactly — "git() swallows every
+ * failure, so the ratchet passed exactly when it had no evidence" — so a killed
+ * child now joins the failures that already refuse. This call site needed the
+ * DEADLINE and nothing else.
+ *
+ * The deadline is written inline rather than imported. This file is
+ * materialized from `plugins/src/base/hooks/` into two stack lanes AND runs as
+ * an agent-time hook inside a plugin payload, which has no `./lib/` to import
+ * from — the same accommodation `preflight-secrets.mjs` makes, and the same one
+ * the entry guard below is written out for.
  * @param {string[]} args Git arguments
  * @param {string} [cwd] Working directory
  * @returns {string | null} Captured stdout, or null when git failed
@@ -105,6 +119,9 @@ function git(args, cwd) {
       cwd,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"],
+      // A hang detector, not a budget. `git` reached through PATH on macOS goes
+      // via Apple's xcrun shim, measured over 20s under load in #2887.
+      timeout: 30_000,
     });
   } catch {
     return null;

package/typescript/copy-overwrite/scripts/check-verification-coverage.mjs

@@ -28,6 +28,7 @@
  */
 import { execSync } from "node:child_process";
 
+import { isChildTimeout } from "./lib/bounded-spawn.mjs";
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 const BEHAVIORAL_TYPES = new Set(["feat", "fix"]);
@@ -173,10 +174,31 @@ async function gatherContext() {
   const diffRange = `${base}...${head}`;
   const logRange = `${base}..${head}`;
 
+  // A KILLED child re-raises rather than taking the fallback. The first
+  // caller's fallback is `""`, which makes `changedFiles` empty — and an empty
+  // change set means this gate concludes the pull request requires no
+  // verification coverage and PASSES. So a busy machine would wave through
+  // exactly the change the gate exists to measure, having measured nothing.
+  //
+  // This is a degree worse than the sibling case in
+  // `generate-lisa-owned-hash-ledger.mjs`, and the difference is worth keeping
+  // straight. A ledger built from silence merely VOUCHES FOR NOTHING — it is
+  // empty, and empty is at least a shape someone might notice. This gate
+  // actively CERTIFIES the pull request as needing nothing, which is a positive
+  // claim about work nobody did, recorded as a pass.
+  //
+  // `timeout:` is stated literally rather than imported, because this file is
+  // shipped into a stack lane and read by the conformance scan, which looks for
+  // the option at the call site.
   const runGit = (cmd, fallback) => {
     try {
-      return execSync(cmd, { encoding: "utf8" });
-    } catch {
+      return execSync(cmd, {
+        encoding: "utf8",
+        // A hang detector, not a budget — see #2887 on the xcrun shim.
+        timeout: 30_000,
+      });
+    } catch (error) {
+      if (isChildTimeout(error)) throw error;
       return fallback;
     }
   };