@codyswann/lisa 4.43.1 → 4.44.1

package/all/copy-overwrite/scripts/lisa-hooks/worktree-binding-guard.mjs

@@ -50,7 +50,13 @@
  */
 
 import { execFileSync } from "node:child_process";
-import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import {
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 
@@ -151,6 +157,258 @@ function mainCheckout(cwd) {
   return null;
 }
 
+/**
+ * How much of an executed script this guard will read, in bytes.
+ *
+ * A generated fixture can be megabytes, and a guard that reads all of it on
+ * every Bash call is a guard someone switches off.
+ */
+const SCRIPT_READ_LIMIT = 256 * 1024;
+
+/**
+ * Programs that take their operands as DATA and never execute them.
+ *
+ * The same split `block-direct-issue-create.sh` makes, and for the same reason
+ * it had to: a guard that opens every file a command names, then judges the
+ * COMMAND by that FILE's contents, refuses ordinary inspection. Reading a
+ * script that visits another worktree is not visiting it.
+ *
+ * The list is an exemption, not an allowlist. Anything unrecognised is
+ * FOLLOWED, because an interpreter roster fails open on the runner nobody
+ * enumerated.
+ */
+const READ_ONLY_PROGRAMS = new Set([
+  "awk",
+  "basename",
+  "cat",
+  "cksum",
+  "cmp",
+  "comm",
+  "cut",
+  "diff",
+  "dirname",
+  "du",
+  "file",
+  "find",
+  "grep",
+  "egrep",
+  "fgrep",
+  "head",
+  "less",
+  "ls",
+  "md5",
+  "md5sum",
+  "more",
+  "nl",
+  "od",
+  "realpath",
+  "rg",
+  "sed",
+  "sha1sum",
+  "sha256sum",
+  "sort",
+  "stat",
+  "strings",
+  "tail",
+  "tee",
+  "tr",
+  "uniq",
+  "wc",
+  "xxd",
+]);
+
+/** Interpreters whose first non-option operand is the file they run. */
+const EXECUTING_INTERPRETERS = new Set([
+  "bash",
+  "dash",
+  "ksh",
+  "node",
+  "perl",
+  "python",
+  "python3",
+  "ruby",
+  "sh",
+  "zsh",
+  "bun",
+  "deno",
+  "tsx",
+]);
+
+/** Shell builtins that run a file in the CURRENT shell. */
+const SOURCE_BUILTINS = new Set([".", "source"]);
+
+/** Where one command ends and the next begins. */
+const COMMAND_SEPARATORS = /\|\||&&|[;|&\n]/u;
+
+/**
+ * Split a command into tokens, honouring simple quoting.
+ *
+ * Deliberately simple, and the guard fails OPEN when it is not enough — see
+ * {@link scriptReachingForeignTree}. A tokeniser that guessed would be worse
+ * than one that says it does not know.
+ */
+function tokenise(segment) {
+  const tokens = segment.match(/"[^"]*"|'[^']*'|[^\s]+/gu) ?? [];
+  return tokens.map(token => token.replace(/^["']|["']$/gu, ""));
+}
+
+/**
+ * The path this command EXECUTES, or null.
+ *
+ * The command-position question. A path anywhere else is an argument, and an
+ * argument is data.
+ */
+function executedPath(segment) {
+  const tokens = tokenise(segment);
+  if (tokens.length === 0) return null;
+  const [head, ...rest] = tokens;
+  const program = head.split("/").pop() ?? "";
+  if (READ_ONLY_PROGRAMS.has(program)) return null;
+  if (SOURCE_BUILTINS.has(program)) return rest[0] ?? null;
+  if (!EXECUTING_INTERPRETERS.has(program)) {
+    // A command word that is itself a file runs by its shebang.
+    return head.includes("/") ? head : null;
+  }
+  // A known interpreter: the first operand that is not an option.
+  const operand = rest.find(token => !token.startsWith("-"));
+  return operand ?? null;
+}
+
+/**
+ * A worktree root other than `bound` that this text reaches into, or null.
+ *
+ * ## Why this does not enumerate `cd`
+ *
+ * The redirect spellings — `cd`, `git -C`, `--work-tree`, `--git-dir`, a
+ * subshell, `env -C`, a variable holding the path — are an open set, and
+ * enumerating them is the failure this arm exists to end
+ * (CodySwannGT/lisa#3927 states it for the sibling guard). So the question is
+ * inverted the same way the filing guard inverted its own: not *which syntax
+ * moves*, which is unbounded, but *which tokens name a directory in another
+ * worktree*, which is bounded by the file.
+ *
+ * A path only has to RESOLVE. How it arrived does not matter, which is what
+ * makes an unenumerated spelling reach the same verdict as `cd`.
+ *
+ * ## Why comments are stripped first
+ *
+ * A script that merely MENTIONS a sibling worktree — a usage line, a comment,
+ * a log message — would otherwise be refused for describing the thing rather
+ * than doing it. Prose about a subject is the likeliest text to contain the
+ * subject's shapes, and the population that writes it is the people
+ * documenting the guard. A parity classifier elsewhere in this repository was
+ * fooled by exactly that and was caught only by a known-answer control.
+ */
+function foreignTreeIn(text, bound, cwd) {
+  const code = text
+    .split("\n")
+    .map(line => line.replace(/^\s*#.*$/u, ""))
+    .join("\n");
+  for (const raw of code.match(/[^\s'";|&()<>]+/gu) ?? []) {
+    const token = raw.replace(/^["']|["']$/gu, "");
+    if (!token.includes("/")) continue;
+    const candidate = isAbsolute(token) ? token : join(cwd, token);
+    let root;
+    try {
+      if (!statSync(candidate).isDirectory()) continue;
+      root = worktreeRoot(realpathSync(candidate));
+    } catch {
+      continue;
+    }
+    if (root && root !== bound) return root;
+  }
+  return null;
+}
+
+/**
+ * The foreign worktree an executed script reaches, or null.
+ *
+ * ## Why this arm exists at all
+ *
+ * The check above compares `payload.cwd` against the bound root, and that is
+ * the right comparison — but **`payload.cwd` is sampled before the child
+ * process runs**. A script that changes directory internally moves AFTER the
+ * guard has measured. The guard is not wrong about the target; it is right
+ * about a target that stops being the target one instruction later.
+ *
+ * A measurement taken before execution cannot bind what execution does
+ * (CodySwannGT/lisa#3924). So the only thing left is to read what is about to
+ * run.
+ *
+ * ## What this arm does NOT cover, stated rather than implied
+ *
+ * An INLINE redirect — `cd B && git status`, `git -C B status` — is not
+ * refused here. Those are already refused by the runtime's own worktree
+ * isolation, and duplicating a control is how two controls drift into
+ * disagreeing. The scripted form is the one neither covers, and it is the only
+ * cell this arm fills.
+ *
+ * ## A relative script path is resolved against `payload.cwd`, and that is a
+ * KNOWN limitation shared with `parity-safety-net.sh`
+ *
+ * CodySwannGT/lisa#3933, filed against that guard, is the same defect: a
+ * relative token is resolved against the hook process's working directory, not
+ * against the directory the command will have once it runs its own leading
+ * `cd`. So `cd <other tree> && bash scripts/foo.sh` reads THIS tree's copy of
+ * `scripts/foo.sh` and reports on it with full confidence.
+ *
+ * It matters here for the same reason it matters there: on a machine running
+ * many worktrees of one repository, every tree holds its own copy of every
+ * script at the same relative path, and they differ by whatever each lane is
+ * doing. A confident scan of the wrong copy is wrong in both directions, and
+ * the silent one — the copy that will run reaches out, the copy that was read
+ * does not — is the direction this arm exists to prevent.
+ *
+ * NOT fixed here on purpose. #3933 is assigned and its options (honour a
+ * leading `cd`, or fail closed when the effective cwd is uncertain) belong in
+ * one place rather than two: a second implementation of the same resolution is
+ * how two guards drift into disagreeing about which file a command runs.
+ * When that lands, this call site should adopt whatever it produces.
+ *
+ * The exposure here is narrower than there. This arm is reached only after the
+ * session has been confirmed to be in its bound worktree, so the common case
+ * is a relative path resolving inside the tree the session is actually in.
+ *
+ * Fails OPEN and says so, like every other undecidable case in this file.
+ */
+function scriptReachingForeignTree(payload, bound) {
+  const command = payload.tool_input?.command;
+  if (typeof command !== "string" || !command) return null;
+  for (const segment of command.split(COMMAND_SEPARATORS)) {
+    const named = executedPath(segment);
+    if (!named) continue;
+    const path = isAbsolute(named) ? named : join(payload.cwd, named);
+    let text;
+    try {
+      if (statSync(path).size > SCRIPT_READ_LIMIT) {
+        say(`${path} is too large to inspect; NOT enforcing on it`);
+        continue;
+      }
+      text = readFileSync(path, "utf8");
+    } catch {
+      // Not a readable file: nothing was executed that this can read.
+      continue;
+    }
+    const foreign = foreignTreeIn(text, bound, payload.cwd);
+    if (foreign) return { script: path, foreign };
+  }
+  return null;
+}
+
+function reachesOut(script, foreign, bound) {
+  return refuse([
+    "worktree-binding-guard: this command runs a script that reaches into",
+    "another worktree.",
+    `  script:    ${script}`,
+    `  reaches:   ${foreign}`,
+    `  bound to:  ${bound}`,
+    "The directory change lives inside the file, so it happens after this",
+    "guard has measured where the session is. Run the work from the tree it",
+    "belongs to, or acknowledge the move:",
+    acceptanceLine(foreign),
+  ]);
+}
+
 function stateFile(sessionId) {
   const home = process.env.LISA_STATE_HOME || join(homedir(), ".lisa");
   return join(home, "worktree-binding", `${sessionId}.json`);
@@ -331,6 +589,10 @@ function evaluate(payload) {
     return 0;
   }
   if (state.boundRoot !== observed) return displaced(state.boundRoot, observed);
+  // Last, and only once the session is provably where it should be: a script
+  // that moves somewhere else after this check has already run.
+  const reach = scriptReachingForeignTree(payload, observed);
+  if (reach) return reachesOut(reach.script, reach.foreign, observed);
   return 0;
 }
 

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -2460,8 +2460,11 @@ function remoteDefaultRef(remote) {
  * the rule is unchanged and now applied to the unit it was always about.
  * @param {string} input The pre-push stdin stream.
  * @param {string} remote Remote being pushed to.
- * @returns {{localRef: string|undefined, commits: string[]}[]} One entry per
- *   ref update that introduces commits.
+ * @returns {{localRef: string|undefined, commits: string[], scope: string[]}[]}
+ *   One entry per ref update that introduces commits. `scope` is the rev-list
+ *   argument vector the commit list came from, kept so a later question about
+ *   the same range — see {@link ancestryUnreachable} — is asked of the range
+ *   itself rather than re-derived from a list that has already lost its bounds.
  */
 function parsePushGroups(input, remote) {
   const groups = [];
@@ -2488,14 +2491,15 @@ function parsePushGroups(input, remote) {
     groups.push({
       localRef,
       commits: git(args).split("\n").filter(Boolean),
+      scope: args,
     });
   }
   if (groups.length === 0 && input.trim() === "") {
+    const args = ["rev-list", "HEAD", "--not", `--remotes=${remote}`];
     groups.push({
       localRef: undefined,
-      commits: git(["rev-list", "HEAD", "--not", `--remotes=${remote}`])
-        .split("\n")
-        .filter(Boolean),
+      commits: git(args).split("\n").filter(Boolean),
+      scope: args,
     });
   }
   return groups;
@@ -4236,14 +4240,100 @@ function validateCommit(args) {
  * that answer into silence.
  * @param {string} input The pre-push stdin stream.
  * @param {string} remote Remote being pushed to.
- * @returns {{localRef: string|undefined, commits: string[]}[]} Groups to check.
+ * @returns {{localRef: string|undefined, commits: string[], scope: string[]}[]}
+ *   Groups to check.
  */
 function pushGroups(input, remote) {
   const parsed = parsePushGroups(input, remote);
   const carrying = parsed.filter(group => group.commits.length > 0);
   return carrying.length > 0
     ? carrying
-    : [{ localRef: parsed[0]?.localRef, commits: [] }];
+    : [{ localRef: parsed[0]?.localRef, commits: [], scope: [] }];
+}
+
+/**
+ * Whether this range reaches back to the beginning of history.
+ *
+ * THE QUESTION THIS ANSWERS IS "IS MY SCOPE STILL VALID", not "is this commit
+ * traceable", and that is the whole of CodySwannGT/lisa#3719. The new-branch
+ * lane bounds itself with `--not --remotes=<remote>`, which is exact while
+ * reachability holds and silently unbounded the moment it does not. A history
+ * rewrite gives every commit a new object id, so a branch created before one
+ * shares NOTHING with the rewritten remote: the exclusion set removes nothing,
+ * the entire history falls into the range, and the gate then refuses on a
+ * stranger's years-old commit whose work item closed long ago. It computes a
+ * correct answer to the wrong question, and nothing in the refusal says so.
+ *
+ * A ROOT COMMIT IN RANGE IS THE DISCRIMINATOR, and it is deliberately not a
+ * size heuristic. A range that legitimately belongs to one branch begins at a
+ * base the remote can still reach, so the walk stops there — reaching a
+ * parentless commit means it did not stop anywhere, which is the unbounded case
+ * itself rather than a proxy for it. A long branch stays a long branch.
+ *
+ * `--max-parents=0` re-asks the range's OWN rev-list, so the answer costs one
+ * git call whatever the history's size. Filtering the returned commit list
+ * instead would spawn one child per commit — thousands of them in exactly the
+ * case this detects, inside a push gate.
+ * @param {{commits: string[], scope: string[]}} group One pushed ref's range.
+ * @param {string} remote Remote being pushed to.
+ * @returns {boolean} True when the range runs to a parentless commit.
+ */
+export function ancestryUnreachable(group, remote) {
+  if (group.commits.length === 0 || group.scope.length === 0) return false;
+  // A repository's FIRST push carries its root commit legitimately: nothing is
+  // published yet, so the exclusion set is empty because there is nothing to
+  // exclude, not because history moved. Reading that as a rewrite would make
+  // every new repository unpushable — the same defect, inverted.
+  // `--format` is presentation only, and deliberately not asserted on: this
+  // reads the ANSWER's emptiness, not its shape, so emptying the format still
+  // prints for-each-ref's default line for each ref and still prints nothing
+  // for none. A hand-run mutant emptying it survives, and is equivalent rather
+  // than a test gap — the ref pattern beside it is the argument that decides
+  // the answer, and a mutant emptying THAT is killed.
+  const published = git([
+    "for-each-ref",
+    "--count=1",
+    "--format=%(refname)",
+    `refs/remotes/${remote}/`,
+  ]);
+  if (published === "") return false;
+  return git([...group.scope, "--max-parents=0"]) !== "";
+}
+
+/**
+ * The refusal for a range whose base the remote can no longer reach.
+ *
+ * Deliberately says NOTHING about work items. The defect being repaired is that
+ * this push was refused over a stranger's closed ticket, so a message that
+ * still argues about tickets — even the right ones — reproduces the
+ * misdirection at a different address. `selfExplanatory` suppresses the
+ * five-gate checklist for the same reason it is suppressed on the
+ * push-destination refusal: no gate here is cleared by naming a ticket.
+ * @param {string|undefined} localRef The ref being pushed.
+ * @returns {TrackingError} The refusal to raise.
+ */
+export function unreachableAncestryRefusal(localRef) {
+  const branch = localRef
+    ? pushedBranchName(localRef) || localRef
+    : "this branch";
+  const error = new TrackingError(
+    `The commits on ${branch} are no longer reachable from "origin", so this ` +
+      `push cannot tell which of them the branch actually adds.\n\n` +
+      `WHAT HAPPENED: the shared history was rewritten after this branch was ` +
+      `created. Rewriting gives every commit a new identity, so nothing this ` +
+      `branch was built on still exists on the remote — and the check that ` +
+      `normally asks "what is new here?" gets the whole history back instead.\n\n` +
+      `WHY IT IS NOT REFUSING YOUR WORK: the commits it would otherwise ` +
+      `complain about are other people's, from before the rewrite. Nothing is ` +
+      `wrong with what you wrote.\n\n` +
+      `WHAT TO DO: copy your commits onto the current branch instead of ` +
+      `pushing this one as it stands — \`git cherry-pick\` each of your own ` +
+      `commits onto a fresh branch taken from an up-to-date "main", then push ` +
+      `that. Merging "main" into this branch does NOT help: a merge adds a ` +
+      `parent, it cannot make the old commits exist on the remote again.`
+  );
+  error.selfExplanatory = true;
+  return error;
 }
 
 /**
@@ -4392,6 +4482,12 @@ function validatePush(args) {
   const pr = currentPullRequest();
   const target = prTargetGroup(groups, pr);
   for (const group of groups) {
+    // BEFORE the commits are judged, not after: every verdict below is computed
+    // over a range, and a range this wide is not evidence about anything. The
+    // order is the fix — judging first and diagnosing afterwards is what
+    // produced a refusal naming a stranger's closed ticket (#3719).
+    if (ancestryUnreachable(group, remote))
+      throw unreachableAncestryRefusal(group.localRef);
     const outcome = commitOutcome(group.commits, configRef, remote);
     reportPushGroup(
       outcome,

package/dist/configs/vitest/coverage-reports-directory.d.ts

@@ -30,6 +30,76 @@ export declare const COVERAGE_REPORTS_DIR_ENV = "LISA_COVERAGE_REPORTS_DIR";
  * @returns Root-relative path, POSIX-separated as Vitest's own default is.
  */
 export declare function coverageRunDirectory(owner: number, startedAt: number, suffix: string): string;
+/**
+ * Publish one finished run's artifacts to the stable directory, then drop it.
+ *
+ * ## Why isolation alone is not enough
+ *
+ * `reportsDirectory` is the only lever the provider offers, so isolating the
+ * scratch necessarily moves the REPORTS with it. An unpinned run therefore
+ * writes `coverage/.runs/<run>/lcov.info` and never writes `coverage/lcov.info`
+ * again.
+ *
+ * A project upgrading to that behaviour does not get a missing-file error. Its
+ * Sonar keeps reading **the file left there before the upgrade**, indefinitely,
+ * and reports a coverage number that has quietly stopped moving — a wrong value
+ * that looks like a real one, which is the same failure isolation removed from
+ * concurrent runs, relocated one layer out to consumers.
+ *
+ * ## Why this is safe where a mid-run shared directory is not
+ *
+ * Ordering. The provider runs `reportCoverage` -> `generateReports` ->
+ * `cleanAfterRun`, and this runs later still, at process exit. It therefore
+ * moves COMPLETED files, never files a writer is partway through — which is
+ * precisely the distinction that makes the shared-directory `rm` destructive
+ * and this move benign.
+ *
+ * Two concurrent runs publishing together is last-writer-wins per file, and can
+ * leave `lcov.info` from one beside `index.html` from another. That cost is
+ * accepted deliberately: each run still reported its own correct number, and
+ * nothing here can delete a directory another run is writing into.
+ * @param directory - Reports directory as {@link coverageReportsDirectory} returned it
+ * @param expectedName - The run-directory basename this process minted
+ * @returns True when this run's own directory was published and removed
+ */
+export declare function publishCoverageRunDirectory(directory: string, expectedName: string): boolean;
+/**
+ * Remove a run directory this process minted, and nothing else.
+ *
+ * The fallback when publishing could not happen, and the guard is the same one:
+ * the basename must be the name this process generated, so a mis-wired caller
+ * removes nothing rather than removing a directory another run is writing into.
+ * @param directory - Reports directory as {@link coverageReportsDirectory} returned it
+ * @param expectedName - The run-directory basename this process minted
+ * @returns True when the path was this run's own
+ */
+export declare function removeOwnCoverageRunDirectory(directory: string, expectedName: string): boolean;
+/**
+ * Remove run directories belonging to runs that are no longer alive.
+ *
+ * Publishing happens at process exit, so an ordinary run leaves nothing behind.
+ * A run that is `SIGKILL`ed does — and on a contended machine that is routine
+ * rather than exceptional, so without this `coverage/.runs/` accrues one
+ * directory per killed run with nothing ever removing them.
+ *
+ * ## Why liveness is legitimate here and not in a lock
+ *
+ * Reclaiming an abandoned directory is not adjudicating ownership of a
+ * contended resource, and the asymmetry is what makes it safe: a false KEEP is
+ * inert debris, and a false REMOVE is impossible, because a live run's own pid
+ * always probes alive. The lock this module refuses has the opposite asymmetry
+ * — there, a wrong answer releases a lock somebody is holding.
+ *
+ * It introduces no second authority. {@link parseRunRootName} and
+ * {@link isProcessAlive} are the scratch namespace's existing parser and
+ * liveness probe, and these directories are named by {@link runRootName}, so
+ * that parser reads them unchanged. Anything it does not recognise is left
+ * alone.
+ * @param runsRoot - Directory holding the run directories
+ * @param alive - Liveness probe; defaults to the shared one
+ * @returns Basenames of the directories removed
+ */
+export declare function reclaimAbandonedCoverageRunDirectories(runsRoot?: string, alive?: (owner: number) => boolean): readonly string[];
 /**
  * Resolves the coverage reports directory for this run.
  * @param environment - Environment to read; defaults to this process's.

package/dist/configs/vitest/coverage-reports-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coverage-reports-directory.d.ts","sourceRoot":"","sources":["../../../src/configs/vitest/coverage-reports-directory.ts"],"names":[],"mappings":"AAiEA;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AAKpE;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,MAAM,CAER;AAYD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,GAAE,MAAM,CAAC,UAAgB,GACnC,MAAM,CAUR;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}
+{"version":3,"file":"coverage-reports-directory.d.ts","sourceRoot":"","sources":["../../../src/configs/vitest/coverage-reports-directory.ts"],"names":[],"mappings":"AAuEA;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AAkBpE;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,MAAM,CAER;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAyBT;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAWT;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sCAAsC,CACpD,QAAQ,GAAE,MAAoD,EAC9D,KAAK,GAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAwB,GACjD,SAAS,MAAM,EAAE,CAenB;AAYD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,GAAE,MAAM,CAAC,UAAgB,GACnC,MAAM,CAcR;AAkCD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,IAAI,IAAI,CAGpD"}