@codyswann/lisa 4.45.1 → 4.45.3

package/scripts/lib/dependency-tree.mjs

@@ -0,0 +1,136 @@
+/**
+ * dependency-tree — decide whether a gate's dependency tree is resolvable, and
+ * say "cannot measure" in one voice when it is not (CodySwannGT/lisa#3913).
+ *
+ * @remarks
+ * ## The defect this exists for
+ *
+ * The `type-correctness` gate spawns the compiler by PATH:
+ * `node node_modules/typescript/bin/tsc`. With an empty `node_modules` the
+ * SPAWN still succeeds — node starts, and it is node that then cannot find the
+ * module — so the gate's `if (tsc.error)` guard does not fire. node's
+ * "Cannot find module" goes to stderr and does not match the gate's
+ * `file(line,col): error TSxxxx:` pattern, so the parsed-diagnostics map comes
+ * back EMPTY. Every quarantined file then satisfies "has no errors", and the
+ * gate reports:
+ *
+ * ```
+ * ❌ 370 quarantined file(s) now type-check and must leave the list:
+ * Remove them from typecheck-quarantine.json.
+ * ```
+ *
+ * Following that deletes 370 live quarantine entries on the word of a checker
+ * that compiled nothing. The comparison was not wrong — it was correct about an
+ * input it was never entitled to accept.
+ *
+ * ## Why "cannot measure" is a THIRD outcome, not a failure message
+ *
+ * This is the #3888 family: a control that could not establish its subject must
+ * not render identically to one that established it and found nothing. The
+ * sibling exemplar is the review gate's `UNDETERMINED` verdict in
+ * `check-skipped-required-checks.mjs`, whose own comment states the rule this
+ * module follows — resolving an unestablished subject to `success` "would be a
+ * new instance of exactly that".
+ *
+ * A gate whose only surface is an exit code cannot emit a third code that
+ * anything reads, so the fallback is fixed: **fail closed, with the denial as
+ * the first clause.** Never pass. A reader who skims one line must come away
+ * knowing the finding was NOT made, because the natural inference from silence
+ * about errors is that there were none.
+ *
+ * ## The message contract
+ *
+ * {@link cannotMeasure} takes the clauses rather than a finished string so that
+ * no call site can ship three of the four. Every message names:
+ *
+ *  1. the outcome, in a distinct word (`CANNOT MEASURE`);
+ *  2. the inference a reader would otherwise draw, DENIED in words;
+ *  3. why the measurement could not happen;
+ *  4. what to do — including, where one exists, the destructive remedy that
+ *     must NOT be followed.
+ *
+ * Clause 2 is the one that is easy to drop and the only one that stops a
+ * destructive edit, so it is a required parameter.
+ *
+ * @module scripts/lib/dependency-tree
+ */
+import { existsSync } from "node:fs";
+import path from "node:path";
+
+/** The install command that repairs an unresolvable tree. */
+export const INSTALL_COMMAND = "bun install --frozen-lockfile";
+
+/**
+ * The distinct outcome word. Deliberately not "ERROR" or "FAILED": those are
+ * what the gate prints when it DID measure and found something, which is the
+ * confusion this whole module exists to prevent.
+ */
+export const CANNOT_MEASURE = "CANNOT MEASURE";
+
+/**
+ * Names the dependencies a gate needs that are not present under `root`.
+ *
+ * Presence is tested at the exact path the gate will spawn or import, not by
+ * asking whether `node_modules` exists. A partially installed tree — the case
+ * that produced the `knip` sibling of this defect, where `node_modules` was
+ * present but two binaries were not — has a `node_modules` directory and still
+ * cannot answer the question.
+ *
+ * @param {string} root - Directory the gate resolves dependencies against.
+ * @param {ReadonlyArray<string>} relativePaths - Paths under `root` to require,
+ *   each already spelled the way the gate will use it.
+ * @returns {string[]} The missing paths, in the order given.
+ */
+export function missingDependencies(root, relativePaths) {
+  return relativePaths.filter(
+    relative => !existsSync(path.join(root, relative))
+  );
+}
+
+/**
+ * True when a child process signalled failure without producing anything the
+ * caller could read as a finding.
+ *
+ * This is the general form of the defect, and it catches more than an empty
+ * `node_modules`: a broken `tsconfig`, an out-of-memory compiler, a crash. The
+ * three cases are distinguishable in principle and identical in what they
+ * license — nothing.
+ *
+ * The one ambiguous input resolves the safe way. If a compiler ever emitted
+ * real diagnostics in a format the caller's pattern did not match, this reports
+ * "could not measure" rather than "no errors" — and "I could not read the
+ * output" is the honest account of that too.
+ *
+ * A zero exit with no diagnostics is NOT this: that is a clean run, and the
+ * caller is entitled to report it.
+ *
+ * @param {number | null} status - The child's exit status.
+ * @param {number} findingCount - How many findings the caller parsed out.
+ * @returns {boolean} Whether the run was vacuous.
+ */
+export function ranVacuously(status, findingCount) {
+  return status !== 0 && findingCount === 0;
+}
+
+/**
+ * Builds the operator-readable `CANNOT MEASURE` block.
+ *
+ * Returned rather than printed so callers can route it to stderr, a report, or
+ * a test assertion without this module deciding.
+ *
+ * @param {object} clauses - The four required clauses.
+ * @param {string} clauses.gate - The gate's own name, as it prints elsewhere.
+ * @param {string} clauses.denial - What this is NOT reporting, phrased as the
+ *   inference a reader would otherwise draw. Required: it is the clause that
+ *   stops a destructive edit.
+ * @param {string} clauses.because - Why the measurement could not happen.
+ * @param {string} clauses.remedy - What the reader should do instead.
+ * @returns {string} The block, newline-separated, no trailing newline.
+ */
+export function cannotMeasure({ gate, denial, because, remedy }) {
+  return [
+    `${CANNOT_MEASURE} — ${gate} did not run, and is NOT reporting ${denial}.`,
+    `Why: ${because}`,
+    `Do this: ${remedy}`,
+  ].join("\n");
+}

package/scripts/lisa-enforcement-fallback.sh

@@ -278,6 +278,12 @@ resolve_vintages() {
 # Description of the last describe_vintage call.
 vintage_label=""
 
+# Whether that copy could NOT be shown current — stale, or undateable. Kept as a
+# flag rather than re-read out of the label, because a refusal has to branch on
+# it and matching on the word "STALE" inside prose is the kind of coupling that
+# breaks the first time the wording is improved.
+vintage_is_stale=0
+
 # A one-line description of a copy's age, used by both the notice and the
 # attribution line.
 #
@@ -288,10 +294,13 @@ vintage_label=""
 describe_vintage() {
   if [ -z "$1" ]; then
     vintage_label="vintage unknown"
+    vintage_is_stale=1
   elif [ -n "$newest_version" ] && version_older "$1" "$newest_version"; then
     vintage_label="lisa $1, STALE — $newest_version is on this machine"
+    vintage_is_stale=1
   else
     vintage_label="lisa $1"
+    vintage_is_stale=0
   fi
 }
 
@@ -665,6 +674,46 @@ while [ "$index" -lt "$guard_count" ]; do
       printf 'Guard %s exited %s — non-blocking error from %s (%s)\n' \
         "${guard_names[$index]}" "$guard_status" "$script" "$vintage_label" >&2
     fi
+    # A verdict from a copy that cannot be shown current states its own limit,
+    # here, attached to the verdict rather than to the session.
+    #
+    # WHY THIS IS NOT THE VINTAGE SUFFIX AGAIN. The suffix names a version; it
+    # does not say what follows from it, and a version number is not an
+    # instruction. The session-start notice DOES say what follows — and it is
+    # rate-limited per session, so a long-running session receives it once, at
+    # the beginning. One session measured 2026-09-04 had its notice written
+    # 34 hours before the refusals it existed to explain, and its vintage was
+    # computed at start, when there was nothing yet to report: a session that
+    # begins current and goes stale while running is told nothing, ever
+    # (CodySwannGT/lisa#3942).
+    #
+    # So the failure was never that the warning was ignored. It was delivered
+    # to a session, once, and the thing it warns about happens to a COMMAND.
+    # This block is keyed to the event instead: every refusal a
+    # not-provably-current copy emits carries what the reader has to know to
+    # avoid acting on it.
+    #
+    # The last line is the load-bearing one and is the reason this is not
+    # advisory prose. A refusal from a stale copy is indistinguishable from a
+    # refusal from current source, so an agent that re-runs it to check gets a
+    # SECOND confirmation of the same wrong thing — the observation is fresh
+    # and its subject is not. Two tickets were filed on 2026-09-04 against
+    # behaviour fixed the previous day, one of them re-verified live
+    # specifically to avoid citing a stale observation.
+    if [ "$vintage_is_stale" -eq 1 ]; then
+      {
+        printf '\nTHIS VERDICT MAY NOT REFLECT CURRENT SOURCE — the copy that produced it\n'
+        printf 'is not provably current (%s).\n' "$vintage_label"
+        if [ "${guard_trees[$index]}" = "host" ]; then
+          printf '  repair: %s\n' "$HOST_REPAIR"
+        else
+          printf '  repair: %s\n' "$PLUGIN_REPAIR"
+        fi
+        printf 'Before filing a defect on this behaviour, read the guard on your\n'
+        printf 'integration branch. Re-running the command confirms nothing: it asks\n'
+        printf 'the same stale copy again.\n'
+      } >&2
+    fi
   fi
   # 2 is the ONLY status Claude Code treats as a refusal. Every other non-zero
   # is a non-blocking error: it is surfaced, and the tool call proceeds anyway.

package/typescript/copy-contents/.husky/pre-push

@@ -126,6 +126,51 @@ if ! command -v jq >/dev/null 2>&1; then
   exit 1
 fi
 
+# The DEPENDENCY TREE is proved here too, for the same reason and one worse
+# consequence (CodySwannGT/lisa#3913).
+#
+# Every gate below resolves its tool out of `node_modules` — knip, vitest, tsc.
+# An empty tree does not stop those gates; it makes them answer from nothing,
+# and an empty answer is not silent. Upstream, the `type-correctness` gate is
+# what showed this belongs here rather than inside each gate: with no compiler
+# to run it parsed zero diagnostics, concluded from that emptiness that every
+# quarantined file now compiles, and instructed a reader to delete the
+# quarantine entries protecting them — a destructive edit ordered by a control
+# whose inputs never resolved. Its sibling `knip:check` reports unlisted
+# binaries from the identical cause. That one merely LOOKS odd and nobody acts
+# on it, which is exactly why it went unfixed while the dangerous one hid
+# behind it.
+#
+# So this is not a convenience check for a missing install. Absence of the
+# dependencies and absence of findings must not produce the same observable. A
+# check that cannot RUN is not a skip and not a pass — it blocks.
+if [ -f package.json ]; then
+  LISA_DECLARED_DEPS="$(jq -r '((.dependencies // {}) + (.devDependencies // {})) | length' package.json 2>/dev/null)"
+  # A non-numeric or absent answer counts as zero: this guard may not be the
+  # thing that blocks a push over an unreadable package.json.
+  case "$LISA_DECLARED_DEPS" in
+    "" | *[!0-9]*) LISA_DECLARED_DEPS=0 ;;
+  esac
+  # `ls -A` covers absent and present-but-empty in one test, which is the
+  # distinction the gates themselves cannot make.
+  if [ "$LISA_DECLARED_DEPS" -gt 0 ] && [ -z "$(ls -A node_modules 2>/dev/null)" ]; then
+    echo "❌ Push blocked: CANNOT MEASURE — dependencies are not installed."
+    echo ""
+    echo "   package.json declares $LISA_DECLARED_DEPS dependencies and node_modules is"
+    echo "   absent or empty, so the gates below cannot resolve the tools they"
+    echo "   run: tsc, knip and vitest."
+    echo ""
+    echo "   This is NOT a finding about your code, and nothing below it is"
+    echo "   either."
+    echo ""
+    echo "To fix:"
+    echo "  bun install --frozen-lockfile   # or your package manager's equivalent"
+    echo ""
+    exit 1
+  fi
+  unset LISA_DECLARED_DEPS
+fi
+
 # BEGIN: push destination guard
 # ---------------------------------------------------------------------------
 # Refuse a push whose RESOLVED destination is a deploy branch it was not aimed