@codyswann/lisa 4.55.1 → 4.55.3

package/all/copy-overwrite/scripts/check-orphaned-branches.mjs

@@ -90,7 +90,7 @@ import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 // resolves there exactly as it does here. Imported rather than reimplemented:
 // a second lane parser is a second answer to `whose is this?`, and two
 // answers is the state this report exists to end.
-import { parseLaneId, workItemLines } from "./lisa-work-item.mjs";
+import { parseLaneId, soleWorkItem, workItemLines } from "./lisa-work-item.mjs";
 
 /** Branch name prefixes that are never work-in-flight. */
 const IGNORED_PREFIXES = Object.freeze(["backup/", "gh-readonly-queue/"]);
@@ -138,8 +138,8 @@ const REF_SOURCE = Object.freeze({ NAME: "branch name", TRAILER: "trailer" });
  */
 const REF_IN_SEGMENT = /^(?:[a-z]+-)*[a-z]{0,4}(\d{2,})(?![0-9a-z])/u;
 
-/** A work-item reference inside a `Work-Item:` trailer value. */
-const REF_IN_TRAILER = /(?:^|\D)(\d{2,})/u;
+/** A failed tip read must remain distinguishable from a missing lane stamp. */
+export const UNREADABLE_LANE = "unreadable";
 
 /** `20260904`: a compact `yyyymmdd` date, never a work item. */
 const COMPACT_DATE = /^20\d{6}$/u;
@@ -275,23 +275,50 @@ export function branchesAhead(remote = "origin", base = "main") {
  * unread. See the `work-item-trailer-definition` rule (#3747).
  *
  * The branch name remains the fallback for a branch that genuinely carries no
- * trailer, reported as an inference rather than as a fact.
+ * trailer, reported as an inference rather than as a fact. A branch naming
+ * several items cannot be classified from one item's state: leave it unresolved
+ * rather than choosing whichever commit git happened to print first.
  * @param {string} branch Short branch name.
  * @param {string} base Default branch name.
  * @param {string} remote Remote name.
  * @param {typeof run} exec Command runner.
+ * @param {object} [contract] Tracker contract; the canonical reader resolves it when omitted.
  * @returns {{ref: string, refSource: string} | undefined} The reference.
  */
-export function workItemRef(branch, base, remote = "origin", exec = run) {
+export function workItemRef(
+  branch,
+  base,
+  remote = "origin",
+  exec = run,
+  contract
+) {
   const messages = exec("git", [
     "log",
     "--format=%B",
     `${remote}/${base}..${remote}/${branch}`,
   ]);
-  const [fromTrailer] = workItemLines(messages ?? "");
-  if (fromTrailer) {
-    const digits = REF_IN_TRAILER.exec(fromTrailer);
-    if (digits) return { ref: digits[1], refSource: REF_SOURCE.TRAILER };
+  if (messages === undefined) return undefined;
+  const values = workItemLines(messages);
+  // The canonical reader omits empty values. Count raw column-zero prefixes
+  // too, so an empty declaration stays invalid even beside a valid trailer.
+  const declarations = messages
+    .split(/\r?\n/)
+    .filter(line => /^work-item:/i.test(line));
+  if (declarations.length !== values.length) return undefined;
+  if (values.length > 0) {
+    try {
+      const canonical = soleWorkItem(messages, contract, "branch commits");
+      // This collector reads GitHub issues. A valid reference for a different
+      // tracker is not a GitHub issue number and cannot be looked up with gh.
+      const ref = canonical.split("#")[1];
+      return ref ? { ref, refSource: REF_SOURCE.TRAILER } : undefined;
+    } catch {
+      // probe-direction: fail-closed — an invalid binding leaves the branch
+      // unresolved, so a guessed issue cannot authorize its classification.
+      // Malformed and conflicting bindings are unknown, never permission to
+      // replace the commit evidence with a guess from the branch name.
+      return undefined;
+    }
   }
   const fromName = refInBranchName(branch);
   return fromName ? { ref: fromName, refSource: REF_SOURCE.NAME } : undefined;
@@ -406,12 +433,19 @@ function parseJson(text) {
  * @param {string} base Default branch name.
  * @param {string} remote Remote name.
  * @param {typeof run} exec Command runner.
+ * @param {object} [contract] Tracker contract, forwarded to the canonical trailer reader.
  * @returns {Map<string, WorkItem>} States, keyed by branch.
  */
-export function workItemStates(branches, base, remote = "origin", exec = run) {
+export function workItemStates(
+  branches,
+  base,
+  remote = "origin",
+  exec = run,
+  contract
+) {
   const states = new Map();
   for (const branch of branches) {
-    const found = workItemRef(branch, base, remote, exec);
+    const found = workItemRef(branch, base, remote, exec, contract);
     if (!found) continue;
     const view = parseJson(
       exec("gh", ["issue", "view", found.ref, "--json", "number,state,url"])
@@ -486,7 +520,7 @@ export function divergences(branches, base, remote = "origin", exec = run) {
  * @param {ReadonlyArray<string>} branches Branch names, without the remote.
  * @param {string} remote Remote the branches live on.
  * @param {(command: string, args: string[]) => (string|undefined)} [exec] Runner.
- * @returns {Map<string, string>} Lane id by branch, absent where none is stamped.
+ * @returns {Map<string, string>} Lane id or UNREADABLE_LANE by branch, absent only when no stamp was found.
  */
 export function branchLanes(branches, remote = "origin", exec = run) {
   const lanes = new Map();
@@ -497,7 +531,7 @@ export function branchLanes(branches, remote = "origin", exec = run) {
       "--format=%B",
       `${remote}/${branch}`,
     ]);
-    const lane = message === undefined ? undefined : parseLaneId(message);
+    const lane = message === undefined ? UNREADABLE_LANE : parseLaneId(message);
     if (lane !== undefined) lanes.set(branch, lane);
   }
   return lanes;
@@ -691,6 +725,8 @@ function renderRow(row, base) {
  * @returns {string} The routing clause.
  */
 function routing(row) {
+  if (row.lane === UNREADABLE_LANE)
+    return "tip commit could not be read, so its lane is unknown — retry the read before routing this branch";
   if (row.lane === undefined)
     return "no lane on the tip commit, so this cannot be routed to a session — it predates the stamp, or was made outside a Lisa hook";
   return `produced by ${row.lane} — a session confirms this is its own with \`node scripts/lisa-work-item.mjs lane\``;

package/all/copy-overwrite/scripts/lisa-enforcement-fallback.sh

@@ -856,8 +856,16 @@ if [ -n "$notice_temp_base" ] && [ "$notice_state_trusted" -eq 1 ]; then
   if [ ! -e "$guard_memo_dir" ] && [ ! -L "$guard_memo_dir" ]; then
     (umask 077 && mkdir "$guard_memo_dir") 2>/dev/null || true
   fi
+  # Unlike shared temp ancestors, memo leaves may not be writable by another
+  # account even with the sticky bit: it could pre-create the session child.
+  guard_memo_mode=""
+  guard_memo_mode="$(stat -c '%a' "$guard_memo_dir" 2>/dev/null)" ||
+    guard_memo_mode="$(stat -f '%p' "$guard_memo_dir" 2>/dev/null)" ||
+    guard_memo_mode=""
+  case "$guard_memo_mode" in "" | *[!0-7]*) guard_memo_mode=777 ;; esac
   if [ -d "$guard_memo_dir" ] && [ ! -L "$guard_memo_dir" ] && \
-    [ -O "$guard_memo_dir" ]; then
+    [ -O "$guard_memo_dir" ] &&
+    [ $((8#$guard_memo_mode & 8#0022)) -eq 0 ]; then
     export LISA_GUARD_MEMO_DIR="$guard_memo_dir"
     export LISA_GUARD_MEMO_UID="$notice_uid"
   fi

package/all/copy-overwrite/scripts/lisa-hooks/block-blind-automerge.sh

@@ -283,7 +283,8 @@ NODE_ID_PATTERN = re.compile(r"^[A-Za-z0-9_=-]+$")
 NODE_QUERY = (
     "query($id:ID!){node(id:$id){... on PullRequest"
     "{number url reviewDecision state baseRefName "
-    "commits(last:1){nodes{commit{statusCheckRollup{contexts(first:100){nodes{"
+    "commits(last:1){nodes{commit{statusCheckRollup{contexts(first:100){"
+    "pageInfo{hasNextPage} nodes{"
     "__typename ... on CheckRun{name conclusion} "
     "... on StatusContext{context state}"
     "}}}}}}}}}"
@@ -297,9 +298,13 @@ NODE_QUERY = (
 # checks, which is genuinely not failing and gets an empty list. A node without
 # the scaffolding is a probe that never asked, and it must leave the key absent
 # so the re-target path can tell the two apart instead of reading both as green.
+# A truncated page is equally unreadable: a failing check may be on the next
+# page, so a green first page cannot authorize an uncovered-base re-target.
 NODE_JQ = (
     "if .data.node == null then null else .data.node as $n "
-    "| if ($n | has(\"commits\")) then ($n | del(.commits)) "
+    "| if ($n.commits.nodes[0].commit.statusCheckRollup.contexts.pageInfo.hasNextPage == true) "
+    "then ($n | del(.commits)) "
+    "elif ($n | has(\"commits\")) then ($n | del(.commits)) "
     "+ {statusCheckRollup: "
     "((($n.commits.nodes[0].commit.statusCheckRollup.contexts.nodes)) // [])} "
     "else $n end end"
@@ -1027,9 +1032,9 @@ not read the pull request's checks.
 
 That ref has ZERO required status checks, so the one thing standing between the
 move and a permission-free gate bypass is whether the PR is currently failing —
-and the probe returned no `statusCheckRollup` at all. An absent rollup is not an
-empty one. Reporting the move as the sanctioned green-PR batching case here
-would be a verdict about a question that was never asked.
+and the probe returned no complete `statusCheckRollup`. An absent or truncated
+rollup is not an empty one. Reporting the move as the sanctioned green-PR
+batching case here would claim a result the probe did not establish.
 
 Re-target through `gh pr edit --base` instead, which reads the checks, or fix
 the probe. Do not report the PR as batched until something has actually looked.

package/all/copy-overwrite/scripts/lisa-hooks/block-direct-issue-create.sh

@@ -2109,6 +2109,10 @@ def unparseable_reads_only(text):
     Returns:
         True when every segment's command word is a known reader.
     """
+    # Unlexable operands cannot be certified as data when shell substitutions
+    # may execute inside them. Preserve the plain apostrophe reader exemption.
+    if any(operator in text for operator in ("$(", "`", "<(", ">(")):
+        return False
     words = raw_command_words(text)
     return bool(words) and all(word in READ_ONLY_PROGRAMS for word in words)
 

package/all/copy-overwrite/scripts/lisa-hooks/block-managed-file-edits.sh

@@ -569,6 +569,7 @@ EOF
 import os
 import re
 import shlex
+import sys
 
 command = os.environ.get("MANAGED_EDIT_COMMAND", "")
 project = os.environ.get("MANAGED_EDIT_PROJECT", "") or os.getcwd()
@@ -579,6 +580,7 @@ project = os.environ.get("MANAGED_EDIT_PROJECT", "") or os.getcwd()
 FOLLOW_MAX_BYTES = 262144
 FOLLOW_MAX_FILES = 8
 FOLLOW_MAX_DEPTH = 3
+ENV_SPLIT_UNRESOLVED = 42
 
 # Spelled with chr() rather than backslash escapes on purpose. This source is
 # embedded in a shell heredoc and copied verbatim through several generators
@@ -610,7 +612,7 @@ FOLLOW_WRAPPERS = {
     # positional count: the walk below re-enters its assignment skip on the
     # next iteration and steps over as many as are present.
     "env": (
-        frozenset({"-C", "--chdir", "-P", "-S", "--split-string", "-u", "--unset"}),
+        frozenset({"-C", "--chdir", "-P", "-u", "--unset"}),
         0,
     ),
     "exec": (frozenset({"-a"}), 0),
@@ -744,6 +746,31 @@ def statements(tokens):
     return grouped
 
 
+class UnresolvedEnvSplit(ValueError):
+    """Split-string syntax whose executed arguments cannot be proven here."""
+
+
+def parse_env_split(split_string):
+    """Parse only the env -S subset shared with ordinary quoted arguments.
+
+    GNU env has its own escapes, comments and environment interpolation. Do
+    not pretend shlex implements those, or invent environment values in a
+    pre-execution guard. The operator can spell the resulting command directly.
+
+    Args:
+        split_string: The literal argument supplied to env's split option.
+
+    Returns:
+        Arguments for the supported subset; otherwise raises UnresolvedEnvSplit.
+    """
+    if any(marker in split_string for marker in (BACKSLASH, "#", "$", chr(96), chr(11), chr(12))):
+        raise UnresolvedEnvSplit("escapes, comments, shell substitution, variable expansion or control whitespace")
+    try:
+        return shlex.split(split_string, comments=False, posix=True)
+    except ValueError as error:
+        raise UnresolvedEnvSplit("unbalanced quoting") from error
+
+
 def command_word(statement):
     """The program a statement runs, and the tokens after it.
 
@@ -760,6 +787,7 @@ def command_word(statement):
         its command word is itself the executed script.
     """
     index = 0
+    split_expansions = 0
     while index < len(statement):
         token = statement[index]
         if "=" in token and not token.startswith(("=", "-")):
@@ -775,6 +803,36 @@ def command_word(statement):
             if option == "--":
                 index += 1
                 break
+            # env -S inserts the split string back into env's argument list;
+            # it is executable input, not an option value to discard. Keep
+            # shell -c's quoted operand intact while expanding the env layer.
+            # The known no-operand flags can be combined before S (-vS/-ivS).
+            # Stop at S: the rest belongs to its argument, not more flags.
+            short_split = re.match(r"^-[iv0]*S(.*)$", option)
+            if program == "env" and (
+                option == "--split-string"
+                or option.startswith("--split-string=")
+                or short_split is not None
+            ):
+                consumed = 1
+                if option == "--split-string" or (
+                    short_split is not None and not short_split.group(1)
+                ):
+                    if index + 1 >= len(statement):
+                        raise UnresolvedEnvSplit("missing split-string operand")
+                    split_string = statement[index + 1]
+                    consumed = 2
+                elif option.startswith("--split-string="):
+                    split_string = option.split("=", 1)[1]
+                else:
+                    split_string = short_split.group(1)
+                if split_expansions >= 64:
+                    raise UnresolvedEnvSplit("nested split-string limit")
+                expanded = parse_env_split(split_string)
+                statement = [token] + expanded + statement[index + consumed :]
+                split_expansions += 1
+                index = 0
+                break
             index += 2 if option in separate else 1
         index += positional
     return (None, None, [])
@@ -988,7 +1046,11 @@ def collect(text, depth, seen, out):
 
 
 targets = []
-collect(command, 0, set(), targets)
+try:
+    collect(command, 0, set(), targets)
+except UnresolvedEnvSplit as error:
+    sys.stderr.write(str(error) + NEWLINE)
+    sys.exit(ENV_SPLIT_UNRESOLVED)
 for target in targets:
     cleaned = target.strip().strip("'\"")
     if cleaned:
@@ -1006,6 +1068,15 @@ PY
     else
       analyzer_status=$?
     fi
+    if [ "$analyzer_status" -eq 42 ]; then
+      printf 'Blocked: cannot resolve env --split-string for managed-file protection.\n' >&2
+      printf 'Use an explicit command without split-string escapes, comments or variable expansion.\n' >&2
+      while IFS= read -r analyzer_line; do
+        [ -n "$analyzer_line" ] && printf '  %s\n' "$analyzer_line" >&2
+      done <"$analyzer_stderr"
+      rm -f "$analyzer_stderr"
+      exit 2
+    fi
     if [ "$analyzer_status" -ne 0 ]; then
       printf 'block-managed-file-edits: Bash analyzer failed (exit %s); Bash write protection is NOT active\n' "$analyzer_status" >&2
       while IFS= read -r analyzer_line; do

package/all/copy-overwrite/scripts/lisa-hooks/guard-dedupe.bash

@@ -54,12 +54,9 @@
 #      refusal reaching the agent without the message that explains it. On a
 #      refusal every channel evaluates and speaks exactly as it does today.
 #
-# COST ON THE PATH THAT GETS NO BENEFIT. A host with one channel must not pay
-# for a mechanism it cannot use. The channel check is builtins only — one small
-# file read, no subshell, no fork — and returns before the digest is computed
-# unless a second channel has actually been seen. The digest, and the one `stat`
-# that feeds it the per-call discriminator, are reached only where a second
-# channel is live, which is exactly where they are repaid.
+# State ownership, modes and ancestry are verified before channel discovery.
+# After that validation the channel check uses only builtins, and returns
+# before digesting code or sizing the transcript unless another channel is live.
 
 # Key this guard would memoise under, once computed. Empty means "record
 # nothing on exit".
@@ -77,14 +74,25 @@ lisa_guard_memo_ready=0
 # Digest tool for the memo key, resolved once. Empty disables the memo.
 lisa_guard_memo_digest_tool=""
 
-# Whether a directory is a real directory this user owns, and not a symlink —
-# builtins only, so this costs no process.
-#
-# `-O` is the load-bearing test: a memo planted by another user would suppress a
-# refusal, so a directory this user does not own is never used. The dispatcher
-# validates the whole parent chain before exporting `LISA_GUARD_MEMO_DIR`; this
-# re-checks the leaf rather than trusting the environment variable, because an
-# exported path is an input like any other.
+# Read ownership and all permission bits without accepting output from a
+# failed platform-specific stat invocation.
+# $1 - directory; sets lisa_guard_memo_owner and lisa_guard_memo_mode
+lisa_guard_memo_stat() {
+  local facts=""
+  facts="$(stat -c '%u %a' "$1" 2>/dev/null)" ||
+    facts="$(stat -f '%u %p' "$1" 2>/dev/null)" || return 1
+  lisa_guard_memo_owner="${facts%% *}"
+  lisa_guard_memo_mode="${facts#* }"
+  case "$lisa_guard_memo_owner:$lisa_guard_memo_mode" in
+    *[!0-9:]* | :* | *:) return 1 ;;
+  esac
+  case "$lisa_guard_memo_mode" in *[!0-7]*) return 1 ;; esac
+  lisa_guard_memo_mode=$((8#$lisa_guard_memo_mode & 8#7777))
+}
+
+# Memo leaves must be private even when a sticky shared temp ancestor is safe.
+# Ownership alone allows another local account to plant a session/allow file
+# in an owned but group- or world-writable directory.
 #
 # $1 - candidate directory
 lisa_guard_memo_dir_usable() {
@@ -92,23 +100,42 @@ lisa_guard_memo_dir_usable() {
   [ -d "$1" ] || return 1
   [ ! -L "$1" ] || return 1
   [ -O "$1" ] || return 1
+  lisa_guard_memo_stat "$1" || return 1
+  [ $((lisa_guard_memo_mode & 8#0022)) -eq 0 ]
+}
+
+# Resolve parents physically and verify every ancestor. Plugin hooks do not
+# inherit the dispatcher's trust walk, and exported paths are still inputs.
+# $1 - candidate memo base; sets lisa_guard_memo_base only on success
+lisa_guard_memo_trust_base() {
+  lisa_guard_memo_dir_usable "$1" || return 1
+  local physical=""
+  physical="$(cd "$1" 2>/dev/null && pwd -P)" || return 1
+  local current="$physical"
+  while :; do
+    lisa_guard_memo_stat "$current" || return 1
+    [ "$lisa_guard_memo_owner" = 0 ] || [ -O "$current" ] || return 1
+    if [ $((lisa_guard_memo_mode & 8#0022)) -ne 0 ] &&
+      [ $((lisa_guard_memo_mode & 8#1000)) -eq 0 ]; then
+      return 1
+    fi
+    [ "$current" != / ] || break
+    current="${current%/*}"
+    [ -n "$current" ] || current=/
+  done
+  lisa_guard_memo_base="$physical"
 }
 
 # Establish the memo base directory.
 #
-# Preferred source is `LISA_GUARD_MEMO_DIR`, exported by the dispatcher, which
-# has already resolved `TMPDIR` physically and walked every parent for ownership
-# and mode. Guards it spawns therefore pay nothing for that walk. A guard
-# reached by the plugin channel has no such parent, so it creates the directory
-# itself under `TMPDIR` — private by umask, and used only when this user owns
-# it. If neither works the memo is unavailable and every guard evaluates, which
-# is today's behaviour.
+# Preferred source is `LISA_GUARD_MEMO_DIR`, exported by the dispatcher. Both
+# this input and the plugin channel's TMPDIR fallback receive the same trust
+# checks. Missing state is created privately; untrusted state disables memo use.
 lisa_guard_memo_resolve_base() {
   [ -z "$lisa_guard_memo_base" ] || return 0
 
   local candidate="${LISA_GUARD_MEMO_DIR:-}"
-  if lisa_guard_memo_dir_usable "$candidate"; then
-    lisa_guard_memo_base="$candidate"
+  if lisa_guard_memo_trust_base "$candidate"; then
     return 0
   fi
 
@@ -121,8 +148,7 @@ lisa_guard_memo_resolve_base() {
   if [ ! -e "$candidate" ] && [ ! -L "$candidate" ]; then
     (umask 077 && mkdir -p "$candidate") 2>/dev/null || true
   fi
-  if lisa_guard_memo_dir_usable "$candidate"; then
-    lisa_guard_memo_base="$candidate"
+  if lisa_guard_memo_trust_base "$candidate"; then
     return 0
   fi
   return 1
@@ -168,6 +194,7 @@ lisa_guard_memo_sweep() {
 #
 # $1 - guard name, used only to name the memo file
 # $2 - the raw tool payload this guard was handed on stdin
+# Remaining arguments - files containing delegated verdict code
 lisa_guard_dedupe() {
   local guard_name="${1:-}"
   local payload="${2:-}"
@@ -197,8 +224,7 @@ lisa_guard_dedupe() {
       fresh_session=1
     fi
   fi
-  [ -d "$session_dir" ] || return 0
-  [ ! -L "$session_dir" ] || return 0
+  lisa_guard_memo_dir_usable "$session_dir" || return 0
 
   # Swept once, by the process that created the session directory, so a
   # long-lived machine does not accumulate memo state. Off the hot path by
@@ -281,11 +307,18 @@ lisa_guard_dedupe() {
   case "$transcript_size" in "" | *[!0-9]*) return 0 ;; esac
 
   # One command substitution, covering everything the verdict depends on: the
-  # guard's own bytes, this library's bytes, the payload, and which call it is.
+  # guard's own bytes, this library, delegated code, payload, and call identity.
+  # Keep literal bytes (including trailing newlines), and propagate every read
+  # failure. A successful digest of a partial stream is not proof of identity.
   local key=""
   key="$(
+    set -o pipefail
     {
-      cat "$self_script" "${BASH_SOURCE[0]}" 2>/dev/null
+      local source_file=""
+      for source_file in "$self_script" "${BASH_SOURCE[0]}" "${@:3}"; do
+        cat "$source_file" 2>/dev/null || exit 1
+        printf '\0'
+      done
       printf '\n%s\n' "$payload"
       printf '%s\n' "$transcript_size"
     } | if [ "$lisa_guard_memo_digest_tool" = "shasum" ]; then
@@ -296,6 +329,7 @@ lisa_guard_dedupe() {
   )" || key=""
   key="${key%% *}"
   case "$key" in "" | *[!0-9a-f]*) return 0 ;; esac
+  [ "${#key}" -eq 64 ] || return 0
 
   # One memo file per guard per session, rewritten as the call moves on, so the
   # state directory stays a fixed size however long a session runs. A saturated

package/all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh

@@ -139,7 +139,8 @@ if [ -r "$lisa_guard_dedupe_lib" ]; then
   # shellcheck source=guard-dedupe.bash
   . "$lisa_guard_dedupe_lib"
   trap 'lisa_guard_dedupe_record $?' EXIT
-  lisa_guard_dedupe parity-safety-net "$input"
+  lisa_guard_dedupe parity-safety-net "$input" \
+    "$lisa_guard_hook_dir/parity-safety-net-heredoc.py"
 fi
 
 tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty')"

package/all/copy-overwrite/scripts/lisa-hooks/worktree-binding-guard.sh

@@ -57,7 +57,8 @@ if [ -r "$lisa_guard_dedupe_lib" ]; then
   # shellcheck source=guard-dedupe.bash
   . "$lisa_guard_dedupe_lib"
   trap 'lisa_guard_dedupe_record $?' EXIT
-  lisa_guard_dedupe worktree-binding-guard "$input"
+  lisa_guard_dedupe worktree-binding-guard "$input" \
+    "$lisa_guard_hook_dir/worktree-binding-guard.mjs"
 fi
 
 if ! command -v node >/dev/null 2>&1; then

package/all/copy-overwrite/scripts/lisa-run-gates.mjs

@@ -679,7 +679,7 @@ function summarise(result, priorKills = []) {
         `🛑 ${result.moment}: INTERRUPTED, not completed — ` +
           `${result.interrupted}. ${result.passed.length} of ` +
           `${result.total} gate(s) were proved before it stopped; the rest ` +
-          `were not run. This is NOT a pass.`
+          `were not proved. This is NOT a pass.`
       );
     }
     return lines;
@@ -817,7 +817,7 @@ function verdictFor(gate, { proved, blockedBy, exec, siblings, declarations }) {
  * @param {function({kind: string, gateId: string}): boolean} [options.recordKill]
  *   Kill-marker writer, injectable so marker cardinality can be proved without
  *   writing to the host's shared marker directory.
- * @param {function(): (string|null)} [options.interrupted] Asks, between gates,
+ * @param {function(): (string|null)} [options.interrupted] Asks, between gates and before returning,
  *   whether the run this chain serves is still there. Injectable for the same
  *   reason `exec` is: a test states that the caller went away instead of having
  *   to kill a real hook mid-chain.
@@ -941,6 +941,11 @@ export function runGates({
       blockedBy = gate.id;
   }
 
+  // The caller may disappear while the FINAL gate executes. There is then no
+  // next iteration to observe it, and an optional gate cannot block on its own.
+  // Record the interruption before this result can claim completion.
+  interruption ??= interrupted();
+
   const bucket = state => results.filter(entry => entry.state === state);
   const result = {
     moment,