@codyswann/lisa 4.42.6 → 4.43.0

package/dist/migrations/ensure-deploy-outcome-guard.js

@@ -0,0 +1,238 @@
+/**
+ * Repair an already-seeded `deploy.yml` whose deploy job goes SILENT when its
+ * release fails (CodySwannGT/lisa#3740).
+ *
+ * ## Why a migration and not a template fix
+ *
+ * #3467 found a deploy job that was SKIPPED rather than failed when its release
+ * failed. GitHub renders a skipped job as neutral and counts a skipped required
+ * check as satisfied, so the deploy that never happened left no signal
+ * anywhere: release commit present, versions matching, every status green. A
+ * consuming repository ran eight days that way.
+ *
+ * #3738 fixed the templates. Those templates are `create-only` — Lisa seeds
+ * `deploy.yml` once and never overwrites it, because the host owns that file —
+ * so the fix reaches new adoptions and reaches nothing that already exists,
+ * which is precisely where the defect is live. `copy-overwrite` would clobber
+ * host customizations, and no reusable workflow can force a caller's job to
+ * run. A migration is the surface that reaches the installed base, exactly as
+ * `ensure-nightly-e2e-workflow-pins` does for the same `create-only` wall
+ * (#3476, #3485).
+ *
+ * ## What it will and will not touch
+ *
+ * It repairs a deploy job only when it can do BOTH halves: suppress the
+ * implicit `success()` so the job runs on a failed release, and insert the
+ * guard step that then fails it loudly. Half of that repair would be worse than
+ * the defect — a deploy job that runs on a failed release with nothing checking
+ * the release result would try to ship.
+ *
+ * It declines, leaving the doctor finding to report the file, when:
+ *
+ * - the run is `postinstallSafe`. Nobody types `bun install` meaning to rewrite
+ *   a reviewed, checked-in workflow, and the interface says so outright;
+ * - the condition needs a rewrite this cannot make without guessing;
+ * - the file's shape cannot be located unambiguously;
+ * - the edited file does not parse, or does not come back repaired.
+ *
+ * The guard body is lifted from Lisa's own shipped template rather than
+ * reproduced here, so the copy a test keeps identical across the templates is
+ * the copy a host receives.
+ * @module migrations/ensure-deploy-outcome-guard
+ */
+import { readFile, writeFile } from "node:fs/promises";
+import * as path from "node:path";
+import { deployJobsSkippedByFailedRelease, releaseDependence, } from "../core/deploy-release-dependence.js";
+import { parseRepositoryWorkflows, } from "../cli/doctor-readiness-workflows.js";
+import { isJsonObject } from "../sync/json-path.js";
+import { loadYaml } from "../utils/yaml.js";
+import { GUARD_STEP_NAME, rewrittenCondition, } from "./deploy-outcome-guard-edit.js";
+import { applyGuardEdits, extractGuardStep, } from "./deploy-outcome-guard-yaml.js";
+/**
+ * The shipped template the guard step is read out of.
+ *
+ * The rails one specifically: its guard names the environment as
+ * `github.ref_name`, which resolves in any repository, while the expo copy
+ * reads an output only that workflow's job graph publishes. The `run:` body is
+ * identical in both — a test asserts it — so this choice is about the `env:`
+ * block travelling safely, not about the words an operator reads.
+ */
+const GUARD_TEMPLATE = path.join("rails", "create-only", ".github", "workflows", "deploy.yml");
+/** The release job id the shipped template's guard step refers to. */
+const TEMPLATE_RELEASE_JOB = "release";
+/**
+ * Re-read one job out of an edited workflow source.
+ * @param source - The edited workflow source
+ * @param jobId - The job to read back
+ * @returns The job's condition and first step name, or null when unreadable
+ */
+function readBackJob(source, jobId) {
+    try {
+        const document = loadYaml(source);
+        if (!isJsonObject(document) || !isJsonObject(document.jobs))
+            return null;
+        const job = document.jobs[jobId];
+        if (!isJsonObject(job))
+            return null;
+        const steps = Array.isArray(job.steps) ? job.steps : [];
+        const first = steps[0];
+        return {
+            ifCondition: typeof job.if === "string" ? job.if : "",
+            firstStep: isJsonObject(first) && typeof first.name === "string" ? first.name : "",
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether an edited source really repaired the job it claims to have repaired.
+ *
+ * The post-condition, not a formality: a mis-indented insertion produces a file
+ * that still parses and still skips, and writing that would replace a reported
+ * defect with an unreported one.
+ * @param source - The edited workflow source
+ * @param job - The job as originally parsed
+ * @param release - The upstream release job's id
+ * @returns True when the job now survives a failed release and carries the guard
+ */
+function repairHolds(source, job, release) {
+    const readBack = readBackJob(source, job.id);
+    if (readBack === null)
+        return false;
+    if (readBack.firstStep !== GUARD_STEP_NAME)
+        return false;
+    return (releaseDependence({ ...job, ifCondition: readBack.ifCondition }, release)
+        .kind === "independent");
+}
+/**
+ * Turn one parsed job into the shape the dependence analysis reads.
+ * @param job - The parsed workflow job
+ * @returns The analysis input
+ */
+function asDependenceJob(job) {
+    return {
+        id: job.id,
+        name: job.name,
+        needs: job.needs,
+        ifCondition: job.ifCondition,
+        environment: job.environment,
+    };
+}
+/**
+ * Repair every repairable deploy job in one workflow's source.
+ * @param source - The host workflow's source
+ * @param workflow - The parsed workflow
+ * @param guardStep - The guard step's lines, de-indented to column zero
+ * @returns The repaired source and the jobs repaired, or null when none were
+ */
+function repairWorkflow(source, workflow, guardStep) {
+    const found = deployJobsSkippedByFailedRelease(workflow.jobs.map(asDependenceJob));
+    const repaired = found.reduce((carried, entry) => {
+        const condition = rewrittenCondition(entry.job, entry.release);
+        if (condition === null)
+            return carried;
+        const guard = guardStep.map(line => line.replaceAll(`needs.${TEMPLATE_RELEASE_JOB}.result`, `needs.${entry.release}.result`));
+        const edited = applyGuardEdits(carried.source, entry.job.id, condition, guard);
+        if (edited === null || !repairHolds(edited, entry.job, entry.release)) {
+            return carried;
+        }
+        return { source: edited, jobs: [...carried.jobs, entry.job.id] };
+    }, { source, jobs: [] });
+    return repaired.jobs.length === 0 ? null : repaired;
+}
+/**
+ * Bring an already-seeded deploy workflow up to the #3467 outcome contract.
+ */
+export class EnsureDeployOutcomeGuardMigration {
+    name = "ensure-deploy-outcome-guard";
+    description = "Make an already-seeded deploy job fail loudly instead of skipping silently when its release does not succeed";
+    /**
+     * Whether any host deploy workflow can be repaired.
+     * @param ctx - Migration context
+     * @returns True when at least one workflow would change
+     */
+    async applies(ctx) {
+        return (await this.plan(ctx)).length > 0;
+    }
+    /**
+     * Rewrite every repairable deploy workflow.
+     * @param ctx - Migration context
+     * @returns Applied or no-op result
+     */
+    async apply(ctx) {
+        const edits = await this.plan(ctx);
+        if (edits.length === 0) {
+            return { name: this.name, action: "noop" };
+        }
+        const changedFiles = edits.map(edit => edit.relative);
+        const message = `Made ${edits.flatMap(edit => edit.jobs).length} deploy job(s) fail ` +
+            "loudly instead of skipping silently when the release does not succeed";
+        if (ctx.dryRun) {
+            ctx.logger.dry(`Would update ${changedFiles.join(", ")}`);
+            return { name: this.name, action: "applied", changedFiles, message };
+        }
+        for (const edit of edits) {
+            await writeFile(edit.absolute, edit.source);
+        }
+        ctx.logger.success(message);
+        return { name: this.name, action: "applied", changedFiles, message };
+    }
+    /**
+     * Work out which host workflows this run would rewrite.
+     * @param ctx - Migration context
+     * @returns One entry per workflow that can be repaired
+     */
+    async plan(ctx) {
+        // A dependency install is not somebody asking for a reviewed workflow to be
+        // rewritten. The doctor finding reports these instead.
+        if (ctx.postinstallSafe === true)
+            return [];
+        const guardStep = await this.readGuardStep(ctx.lisaDir);
+        if (guardStep === null)
+            return [];
+        const workflows = await parseRepositoryWorkflows(ctx.projectDir);
+        const planned = await Promise.all(workflows.map(async (workflow) => await this.planOne(ctx, workflow, guardStep)));
+        return planned.filter((edit) => edit !== null);
+    }
+    /**
+     * Plan the repair of one workflow.
+     * @param ctx - Migration context
+     * @param workflow - The parsed workflow
+     * @param guardStep - The guard step's lines
+     * @returns The planned edit, or null when nothing here can be repaired
+     */
+    async planOne(ctx, workflow, guardStep) {
+        const absolute = path.join(ctx.projectDir, ...workflow.file.split("/"));
+        try {
+            const source = await readFile(absolute, "utf8");
+            const repaired = repairWorkflow(source, workflow, guardStep);
+            return repaired === null
+                ? null
+                : {
+                    relative: workflow.file,
+                    absolute,
+                    source: repaired.source,
+                    jobs: repaired.jobs,
+                };
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Read the guard step out of Lisa's own shipped deploy template.
+     * @param lisaDir - Lisa installation directory
+     * @returns The step's lines, or null when the template cannot be read
+     */
+    async readGuardStep(lisaDir) {
+        try {
+            const template = await readFile(path.join(lisaDir, GUARD_TEMPLATE), "utf8");
+            return extractGuardStep(template, GUARD_STEP_NAME);
+        }
+        catch {
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=ensure-deploy-outcome-guard.js.map

package/dist/migrations/ensure-deploy-outcome-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-deploy-outcome-guard.js","sourceRoot":"","sources":["../../src/migrations/ensure-deploy-outcome-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAEL,gCAAgC,EAChC,iBAAiB,GAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,wBAAwB,GACzB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EACL,eAAe,EACf,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,eAAe,EACf,gBAAgB,GACjB,MAAM,gCAAgC,CAAC;AAOxC;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAC9B,OAAO,EACP,aAAa,EACb,SAAS,EACT,WAAW,EACX,YAAY,CACb,CAAC;AAEF,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAcvC;;;;;GAKG;AACH,SAAS,WAAW,CAClB,MAAc,EACd,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,QAAQ,GAAY,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAY,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,OAAO;YACL,WAAW,EAAE,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;YACrD,SAAS,EACP,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;SAC1E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAClB,MAAc,EACd,GAAkB,EAClB,OAAe;IAEf,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,QAAQ,CAAC,SAAS,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,CACL,iBAAiB,CAAC,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC;SACtE,IAAI,KAAK,aAAa,CAC1B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAmC;IAC1D,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CACrB,MAAc,EACd,QAAwB,EACxB,SAA4B;IAE5B,MAAM,KAAK,GAAG,gCAAgC,CAC5C,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CACnC,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAI3B,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QACjB,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;QACvC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACjC,IAAI,CAAC,UAAU,CACb,SAAS,oBAAoB,SAAS,EACtC,SAAS,KAAK,CAAC,OAAO,SAAS,CAChC,CACF,CAAC;QACF,MAAM,MAAM,GAAG,eAAe,CAC5B,OAAO,CAAC,MAAM,EACd,KAAK,CAAC,GAAG,CAAC,EAAE,EACZ,SAAS,EACT,KAAK,CACN,CAAC;QACF,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;IACnE,CAAC,EACD,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CACrB,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,iCAAiC;IACnC,IAAI,GAAG,6BAA6B,CAAC;IACrC,WAAW,GAClB,8GAA8G,CAAC;IAEjH;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,GAAqB;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,OAAO,GACX,QAAQ,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,sBAAsB;YACrE,uEAAuE,CAAC;QAC1E,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;QACvE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,IAAI,CAAC,GAAqB;QACtC,4EAA4E;QAC5E,uDAAuD;QACvD,IAAI,GAAG,CAAC,eAAe,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,SAAS,CAAC,GAAG,CACX,KAAK,EAAC,QAAQ,EAAC,EAAE,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,CAC/D,CACF,CAAC;QACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAuB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,OAAO,CACnB,GAAqB,EACrB,QAAwB,EACxB,SAA4B;QAE5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC7D,OAAO,QAAQ,KAAK,IAAI;gBACtB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC;oBACE,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,QAAQ;oBACR,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;iBACpB,CAAC;QACR,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,aAAa,CACzB,OAAe;QAEf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAClC,MAAM,CACP,CAAC;YACF,OAAO,gBAAgB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/migrations/index.d.ts

@@ -1,6 +1,7 @@
 import type { Migration, MigrationContext, MigrationResult } from "./migration.interface.js";
 export type { Migration, MigrationAction, MigrationContext, MigrationResult, } from "./migration.interface.js";
 export { EnsureAuditIgnoreLocalExclusionsMigration } from "./ensure-audit-ignore-local-exclusions.js";
+export { EnsureDeployOutcomeGuardMigration } from "./ensure-deploy-outcome-guard.js";
 export { EnsureJestRnMockAccessibilityManagerMigration } from "./ensure-jest-rn-mock-accessibility-manager.js";
 export { EnsureLearningsGitattributesMigration } from "./ensure-learnings-gitattributes.js";
 export { EnsureLearningsMergeDriverMigration } from "./ensure-learnings-merge-driver.js";

package/dist/migrations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,sCAAsC,CAAC;AAC5F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAElD;;;OAGG;gBACS,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE;IA4B7C;;;OAGG;IACH,MAAM,IAAI,SAAS,SAAS,EAAE;IAI9B;;;;OAIG;IACG,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/D;;;;OAIG;IACG,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC;CAazE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,CAE3D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,sCAAsC,CAAC;AAC5F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAElD;;;OAGG;gBACS,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE;IA6B7C;;;OAGG;IACH,MAAM,IAAI,SAAS,SAAS,EAAE;IAI9B;;;;OAIG;IACG,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/D;;;;OAIG;IACG,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC;CAazE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,CAE3D"}

package/dist/migrations/index.js

@@ -1,4 +1,5 @@
 import { EnsureAuditIgnoreLocalExclusionsMigration } from "./ensure-audit-ignore-local-exclusions.js";
+import { EnsureDeployOutcomeGuardMigration } from "./ensure-deploy-outcome-guard.js";
 import { EnsureJestRnMockAccessibilityManagerMigration } from "./ensure-jest-rn-mock-accessibility-manager.js";
 import { EnsureLearningsGitattributesMigration } from "./ensure-learnings-gitattributes.js";
 import { EnsureLearningsMergeDriverMigration } from "./ensure-learnings-merge-driver.js";
@@ -20,6 +21,7 @@ import { PruneRetiredClaudeDenyRulesMigration } from "./prune-retired-claude-den
 import { ReconcileClaudeStackPluginsMigration } from "./reconcile-claude-stack-plugins.js";
 import { UntrackCodexMarketplaceMigration } from "./untrack-codex-marketplace.js";
 export { EnsureAuditIgnoreLocalExclusionsMigration } from "./ensure-audit-ignore-local-exclusions.js";
+export { EnsureDeployOutcomeGuardMigration } from "./ensure-deploy-outcome-guard.js";
 export { EnsureJestRnMockAccessibilityManagerMigration } from "./ensure-jest-rn-mock-accessibility-manager.js";
 export { EnsureLearningsGitattributesMigration } from "./ensure-learnings-gitattributes.js";
 export { EnsureLearningsMergeDriverMigration } from "./ensure-learnings-merge-driver.js";
@@ -54,6 +56,7 @@ export class MigrationRegistry {
             new EnsureTsconfigLocalIncludesMigration(),
             new EnsureTsconfigLocalFilesFallbackMigration(),
             new EnsureAuditIgnoreLocalExclusionsMigration(),
+            new EnsureDeployOutcomeGuardMigration(),
             new EnsureJestRnMockAccessibilityManagerMigration(),
             new EnsureLearningsGitattributesMigration(),
             new EnsureLearningsMergeDriverMigration(),

package/dist/migrations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,sCAAsC,CAAC;AAC5F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAalF,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,sCAAsC,CAAC;AAC5F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAuB;IAElD;;;OAGG;IACH,YAAY,UAAiC;QAC3C,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI;YAC9B,IAAI,oCAAoC,EAAE;YAC1C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,6CAA6C,EAAE;YACnD,IAAI,qCAAqC,EAAE;YAC3C,IAAI,mCAAmC,EAAE;YACzC,IAAI,uCAAuC,EAAE;YAC7C,IAAI,qCAAqC,EAAE;YAC3C,IAAI,8BAA8B,EAAE;YACpC,IAAI,gCAAgC,EAAE;YACtC,IAAI,wCAAwC,EAAE;YAC9C,IAAI,8BAA8B,EAAE;YACpC,IAAI,kCAAkC,EAAE;YACxC,IAAI,0BAA0B,EAAE;YAChC,IAAI,uCAAuC,EAAE;YAC7C,IAAI,mCAAmC,EAAE;YACzC,IAAI,iCAAiC,EAAE;YACvC,IAAI,oCAAoC,EAAE;YAC1C,IAAI,oCAAoC,EAAE;YAC1C,IAAI,gCAAgC,EAAE;YACtC,0EAA0E;YAC1E,6DAA6D;YAC7D,IAAI,yCAAyC,EAAE;SAChD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,GAAqB;QAC7C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;gBAC/B,MAAM,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,GAAqB;QAChC,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,iBAAiB,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,sCAAsC,CAAC;AAC5F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAalF,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,sCAAsC,CAAC;AAC5F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAuB;IAElD;;;OAGG;IACH,YAAY,UAAiC;QAC3C,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI;YAC9B,IAAI,oCAAoC,EAAE;YAC1C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,iCAAiC,EAAE;YACvC,IAAI,6CAA6C,EAAE;YACnD,IAAI,qCAAqC,EAAE;YAC3C,IAAI,mCAAmC,EAAE;YACzC,IAAI,uCAAuC,EAAE;YAC7C,IAAI,qCAAqC,EAAE;YAC3C,IAAI,8BAA8B,EAAE;YACpC,IAAI,gCAAgC,EAAE;YACtC,IAAI,wCAAwC,EAAE;YAC9C,IAAI,8BAA8B,EAAE;YACpC,IAAI,kCAAkC,EAAE;YACxC,IAAI,0BAA0B,EAAE;YAChC,IAAI,uCAAuC,EAAE;YAC7C,IAAI,mCAAmC,EAAE;YACzC,IAAI,iCAAiC,EAAE;YACvC,IAAI,oCAAoC,EAAE;YAC1C,IAAI,oCAAoC,EAAE;YAC1C,IAAI,gCAAgC,EAAE;YACtC,0EAA0E;YAC1E,6DAA6D;YAC7D,IAAI,yCAAyC,EAAE;SAChD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,GAAqB;QAC7C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;gBAC/B,MAAM,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,GAAqB;QAChC,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,iBAAiB,EAAE,CAAC;AACjC,CAAC"}

package/expo/copy-overwrite/scripts/bdd/baseline.mjs

@@ -143,9 +143,18 @@ export function showAtRevision(root, revision, relative) {
 
 /**
  * List the feature files that existed at a revision.
+ *
+ * Three-state on purpose. `git ls-tree` exits 0 with EMPTY output for a
+ * revision that genuinely holds no features, so a non-zero exit is always
+ * "could not ask" and never "there were none". Handing both back as `[]` let
+ * one failed listing read as an empty baseline, and an empty `before` set
+ * produces no `scenario-deleted` and no `coverage-regression` finding at all —
+ * so the gate reported that nothing regressed having compared against nothing.
+ * That is the same hole `loadBaseline` already closes for the coverage map,
+ * left open on the feature files beside it.
  * @param {string} root - Repo root.
  * @param {string} revision - Commit-ish.
- * @returns {string[]} Repo-relative feature paths.
+ * @returns {{ok: boolean, files: string[]}} Listing, and whether it was taken.
  */
 function featureFilesAt(root, revision) {
   const result = git(root, [
@@ -156,11 +165,16 @@ function featureFilesAt(root, revision) {
     "--",
     "bdd/features",
   ]);
-  if (!result.ok) return [];
-  return result.stdout
-    .split("\n")
-    .map(line => line.trim())
-    .filter(line => line.endsWith(".feature"));
+  // probe-direction: fail-closed — `ok: false` reaches `loadBaseline`, which
+  // records the baseline UNAVAILABLE instead of empty.
+  if (!result.ok) return { ok: false, files: [] };
+  return {
+    ok: true,
+    files: result.stdout
+      .split("\n")
+      .map(line => line.trim())
+      .filter(line => line.endsWith(".feature")),
+  };
 }
 
 /**
@@ -198,12 +212,17 @@ export function loadBaseline(root, revision, headPlatforms = new Set()) {
       error = `bdd/coverage-map.json at that revision is not valid JSON: ${parseError.message}`;
     }
   }
+  const listing = featureFilesAt(root, revision);
   if (binary === null) {
     error = "git was not found, so no base revision could be read";
   } else if (!revisionExists) {
     error = "the requested base does not name a readable commit";
+  } else if (!listing.ok) {
+    error =
+      "the base revision's feature files could not be listed, so no scenario " +
+      "from it could be compared";
   }
-  const documents = featureFilesAt(root, revision)
+  const documents = listing.files
     .map(file => ({ file, source: showAtRevision(root, revision, file) }))
     .filter(document => document.source !== null);
   const platforms = new Set([

package/package.json

@@ -63,6 +63,7 @@
     "check:pipeline-status-reads": "node scripts/check-pipeline-status-reads.mjs",
     "check:whole-output-guards": "node scripts/check-whole-output-guards.mjs",
     "check:empty-subject-guards": "node scripts/check-empty-subject-guards.mjs",
+    "check:probe-absence-direction": "node scripts/check-probe-absence-direction.mjs",
     "check:shell-guard-refusals": "bun run build && $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/check-shell-guard-refusal-coverage.mjs",
     "check:workflow-inputs": "node scripts/detect-stale-workflow-inputs.mjs --project . --project typescript/create-only --project rails/create-only --json",
     "check:conflict-markers": "node all/copy-overwrite/scripts/check-conflict-markers.mjs",
@@ -173,7 +174,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.42.6",
+  "version": "4.43.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -321,7 +322,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "1148474ed60b8770215ec537dd4c949d259cda45",
-  "gitHead": "1148474ed60b8770215ec537dd4c949d259cda45",
-  "lisaReleaseTag": "v4.42.6"
+  "lisaReleaseCommit": "e7ce0fdee9ed37c14c80f0925a1e455c2e88c05f",
+  "gitHead": "e7ce0fdee9ed37c14c80f0925a1e455c2e88c05f",
+  "lisaReleaseTag": "v4.43.0"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.42.6",
+  "version": "4.43.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.42.6",
+  "version": "4.43.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -617,6 +617,17 @@ gh api "repos/<owner>/<repo>/actions/runs?head_sha=<head>" --jq .total_count
 problem. If CI were merely slow you would see runs QUEUED, not absent. Resolve
 the conflict and the runs appear; nothing else will make them appear.
 
+**`<head>` must be the FULL 40-character SHA.** `head_sha=` does not match a
+prefix and does not reject one: an abbreviated SHA returns a clean
+`total_count: 0` — not a 404, not a validation error, an absence shaped exactly
+like "no workflow ran". Measured on one pull request's own head: `77f223b9d` →
+`total_count 0`, `77f223b9d8ffe7b172e9cac48b068b3bcac304c3` → `total_count 4`.
+Take the SHA from `gh pr view <pr> --json headRefOid --jq .headRefOid`, never
+from `git log --oneline` or a truncated line in a log or a UI. Copying a short
+SHA here makes EVERY pull request read as having no CI, and the natural next
+action — rebase and force-push — throws away the live run you could not see
+(#3848).
+
 **`mergeable` is computed asynchronously.** GitHub returns `null` while it is
 still working it out, so a single read on a freshly-opened PR can say `null` on
 a perfectly clean branch. Treat `null` as "cannot tell yet" and re-read — never

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/bootstrap-store.mjs

@@ -218,6 +218,9 @@ export function hasBootstrap(key, deps = {}) {
       );
       return true;
     } catch {
+      // probe-direction: fail-closed — false means "no bootstrap value proven
+      // present", which makes the setup flow ASK for one. A keychain that cannot
+      // be queried costs a redundant prompt, never a skipped bootstrap.
       return false;
     }
   }

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/preflight-secrets.mjs

@@ -270,6 +270,9 @@ export function runProbe(substrate) {
     });
     return true;
   } catch {
+    // probe-direction: fail-closed — false makes the caller behave as if no
+    // substrate existed and fall through to the provider, which is the stricter
+    // path, exactly as the paragraph above states.
     return false;
   }
 }

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/providers.mjs

@@ -178,6 +178,8 @@ function keychainServiceNames() {
       ([, name]) => name
     );
   } catch {
+    // probe-direction: neutral — the names only enrich a diagnostic message on a
+    // path that has already failed; no verdict reads them.
     // A locked, absent, or oversized keychain leaves the list empty.
     return [];
   }
@@ -253,6 +255,8 @@ export function providerCliPresent(prefix) {
       ).trim()
     );
   } catch {
+    // probe-direction: neutral — PATH presence is reported in the explanation of
+    // an already-failing lookup; it gates nothing on its own.
     return false;
   }
 }

package/plugins/lisa/.codex-plugin/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -66,6 +66,9 @@ export function locate(name, exec = boundedChildOutput) {
       exec("command", ["-v", name], { encoding: "utf8", shell: true })
     ).trim();
   } catch {
+    // probe-direction: fail-closed — null means "not proven present", and the
+    // setup flow responds by installing. A probe that cannot answer costs a
+    // redundant install, never a missing tool reported as present.
     return null;
   }
 }

package/plugins/lisa/hooks/threshold-ratchet.mjs

@@ -121,6 +121,10 @@ function git(args, cwd) {
       timeout: 30_000,
     });
   } catch {
+    // probe-direction: fail-closed — null never reaches a verdict as "no
+    // weakening found". `changePlan` turns it into `undeterminable`, which
+    // REFUSES, and `isPromotion` falls to the strict reading that keeps the
+    // allow list pinned to the baseline.
     return null;
   }
 }
@@ -166,6 +170,8 @@ function resolvePlan(mode, root, baseRef, onlyFiles) {
       try {
         return fs.readFileSync(path.join(root, f), "utf-8");
       } catch {
+        // probe-direction: fail-closed — an unreadable current file compares as
+        // absent against the baseline, which is the strict side of the ratchet.
         return null;
       }
     },

package/plugins/lisa/hooks/worktree-binding-guard.mjs

@@ -96,14 +96,35 @@ function git(args, cwd) {
       stdio: ["ignore", "pipe", "ignore"],
     }).trim();
   } catch {
+    // probe-direction: neutral — this helper REPORTS, it does not decide. Both
+    // callers below read null and each one says out loud what it could not do
+    // before returning, so no gate outcome follows from this null silently
+    // (#3848). Keep that true: a caller added here that spends null as an
+    // answer has to say so at its own line.
     return null;
   }
 }
 
-/** The worktree root containing `cwd`, or null when `cwd` is not in a repo. */
+/**
+ * The worktree root containing `cwd`, or null when `cwd` is not in a repo.
+ *
+ * `--show-toplevel` exits non-zero for two OPPOSITE reasons and hands back the
+ * same nothing for both: `cwd` is outside any repository — a real absence, and
+ * a call there is genuinely none of this guard's business — or git could not
+ * answer at all, where the binding is unproven rather than inapplicable. Only
+ * the second is a withdrawal of enforcement, and it is the one that must not
+ * pass for the first. `git --version` succeeds wherever git can run, so its
+ * failure is what separates them.
+ * @param {string} cwd Directory the tool call runs in.
+ * @returns {string|null} Absolute worktree root, or null.
+ */
 function worktreeRoot(cwd) {
   const top = git(["rev-parse", "--show-toplevel"], cwd);
-  return top ? resolve(top) : null;
+  if (top) return resolve(top);
+  if (git(["--version"], cwd) === null) {
+    say("git could not be run here, so the worktree binding is NOT enforced");
+  }
+  return null;
 }
 
 /**
@@ -117,7 +138,14 @@ function mainCheckout(cwd) {
     ["rev-parse", "--path-format=absolute", "--git-common-dir"],
     cwd
   );
-  return common ? dirname(resolve(common)) : null;
+  if (common) return dirname(resolve(common));
+  // Reached only for an `EnterWorktree` naming a worktree, which means a
+  // repository was already in hand — so failing here is "could not ask", and
+  // the consequence is that the claim goes unrecorded and the NEXT call's
+  // displacement check has nothing to compare against. Said out loud rather
+  // than returned as a quiet null (#3848).
+  say("git could not resolve the main checkout, so this claim is NOT recorded");
+  return null;
 }
 
 function stateFile(sessionId) {

package/plugins/lisa/scripts/design-variable-ids.mjs

@@ -298,6 +298,8 @@ async function callMcp(token, tool, args) {
       .map(part => part.text ?? "")
       .join("");
   } catch {
+    // probe-direction: neutral — this is a design-token lookup for a generator;
+    // no gate reads the result, and null renders as a missing token.
     return null;
   }
 }

package/plugins/lisa/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -617,6 +617,17 @@ gh api "repos/<owner>/<repo>/actions/runs?head_sha=<head>" --jq .total_count
 problem. If CI were merely slow you would see runs QUEUED, not absent. Resolve
 the conflict and the runs appear; nothing else will make them appear.
 
+**`<head>` must be the FULL 40-character SHA.** `head_sha=` does not match a
+prefix and does not reject one: an abbreviated SHA returns a clean
+`total_count: 0` — not a 404, not a validation error, an absence shaped exactly
+like "no workflow ran". Measured on one pull request's own head: `77f223b9d` →
+`total_count 0`, `77f223b9d8ffe7b172e9cac48b068b3bcac304c3` → `total_count 4`.
+Take the SHA from `gh pr view <pr> --json headRefOid --jq .headRefOid`, never
+from `git log --oneline` or a truncated line in a log or a UI. Copying a short
+SHA here makes EVERY pull request read as having no CI, and the natural next
+action — rebase and force-push — throws away the live run you could not see
+(#3848).
+
 **`mergeable` is computed asynchronously.** GitHub returns `null` while it is
 still working it out, so a single read on a freshly-opened PR can say `null` on
 a perfectly clean branch. Treat `null` as "cannot tell yet" and re-read — never

package/plugins/lisa/skills/lisa-secrets-access/scripts/bootstrap-store.mjs

@@ -218,6 +218,9 @@ export function hasBootstrap(key, deps = {}) {
       );
       return true;
     } catch {
+      // probe-direction: fail-closed — false means "no bootstrap value proven
+      // present", which makes the setup flow ASK for one. A keychain that cannot
+      // be queried costs a redundant prompt, never a skipped bootstrap.
       return false;
     }
   }

package/plugins/lisa/skills/lisa-secrets-access/scripts/preflight-secrets.mjs

@@ -270,6 +270,9 @@ export function runProbe(substrate) {
     });
     return true;
   } catch {
+    // probe-direction: fail-closed — false makes the caller behave as if no
+    // substrate existed and fall through to the provider, which is the stricter
+    // path, exactly as the paragraph above states.
     return false;
   }
 }

package/plugins/lisa/skills/lisa-secrets-access/scripts/providers.mjs

@@ -178,6 +178,8 @@ function keychainServiceNames() {
       ([, name]) => name
     );
   } catch {
+    // probe-direction: neutral — the names only enrich a diagnostic message on a
+    // path that has already failed; no verdict reads them.
     // A locked, absent, or oversized keychain leaves the list empty.
     return [];
   }
@@ -253,6 +255,8 @@ export function providerCliPresent(prefix) {
       ).trim()
     );
   } catch {
+    // probe-direction: neutral — PATH presence is reported in the explanation of
+    // an already-failing lookup; it gates nothing on its own.
     return false;
   }
 }

package/plugins/lisa/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -66,6 +66,9 @@ export function locate(name, exec = boundedChildOutput) {
       exec("command", ["-v", name], { encoding: "utf8", shell: true })
     ).trim();
   } catch {
+    // probe-direction: fail-closed — null means "not proven present", and the
+    // setup flow responds by installing. A probe that cannot answer costs a
+    // redundant install, never a missing tool reported as present.
     return null;
   }
 }