@codyswann/lisa 4.69.5 → 4.70.1

package/all/copy-overwrite/scripts/lib/history-secret-git.mjs

@@ -0,0 +1,212 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/**
+ * @file history-secret-git.mjs
+ * @description Prove complete pairwise introduced reachability before scanning.
+ * @module history-secrets
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** Authored guidance is distinguishable from filesystem/vendor exceptions. */
+export class HistorySecretError extends Error {}
+
+/** Deterministic Git plumbing must ignore replacements and diff transforms. */
+export const gitEnvironment = () => {
+  const environment = { ...process.env };
+  for (const key of Object.keys(environment)) {
+    if (
+      key.startsWith("GIT_CONFIG_") ||
+      key.startsWith("GITLEAKS_") ||
+      [
+        "GIT_DIR",
+        "GIT_COMMON_DIR",
+        "GIT_WORK_TREE",
+        "GIT_INDEX_FILE",
+        "GIT_OBJECT_DIRECTORY",
+        "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+        "GIT_SHALLOW_FILE",
+        "GIT_REPLACE_REF_BASE",
+        "GIT_NAMESPACE",
+      ].includes(key)
+    )
+      delete environment[key];
+  }
+  return {
+    ...environment,
+    GIT_NO_REPLACE_OBJECTS: "1",
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_CONFIG_GLOBAL: "/dev/null",
+    GIT_CONFIG_COUNT: "0",
+    GIT_OPTIONAL_LOCKS: "0",
+  };
+};
+
+/** Git errors can contain arbitrary payloads; only authored guidance leaves here. */
+export const gitRead = (args, cwd) => {
+  const result = spawnSync(
+    "git",
+    [
+      "--no-replace-objects",
+      "-c",
+      "diff.external=",
+      "-c",
+      "core.quotePath=true",
+      ...args,
+    ],
+    {
+      cwd,
+      env: gitEnvironment(),
+      encoding: "utf8",
+      timeout: 120000,
+      maxBuffer: 64 * 1024 * 1024,
+    }
+  );
+  if (result.error || result.signal || result.status !== 0)
+    throw new HistorySecretError(
+      "Cannot prove complete Git history. Fetch the actual before/head objects and complete history, then retry; repair missing or corrupt objects."
+    );
+  return result.stdout.trim();
+};
+
+/** Validate the entire stream before any scanner or deletion shortcut. */
+export const parsePush = (input, width, cwd = process.cwd()) => {
+  if (input === "") return [];
+  const lines = input.endsWith("\n")
+    ? input.slice(0, -1).split("\n")
+    : input.split("\n");
+  return lines.map(line => {
+    const fields = line.split(" ");
+    if (fields.length !== 4 || fields.some(field => !field))
+      throw new HistorySecretError(
+        "Malformed pre-push input. Supply Git's complete four-field ref records without extra or missing fields."
+      );
+    const [localRef, after, remoteRef, before] = fields;
+    const oid = new RegExp(`^[a-f0-9]{${width}}$`, "u");
+    if (!oid.test(before) || !oid.test(after))
+      throw new HistorySecretError(
+        "Malformed object ID. Supply full lowercase IDs matching the repository object format."
+      );
+    const validRef = ref =>
+      ref.startsWith("refs/") &&
+      spawnSync("git", ["check-ref-format", ref], {
+        env: gitEnvironment(),
+        timeout: 10000,
+        stdio: "ignore",
+      }).status === 0;
+    // Git preserves an explicit revision expression (HEAD~1 or a raw ID) in
+    // local-ref. Its actual supplied object ID remains the range boundary.
+    const validSource = () => {
+      if (localRef.startsWith("refs/")) return validRef(localRef);
+      if (localRef === "(delete)") return /^0+$/u.test(after);
+      try {
+        return (
+          gitRead(
+            [
+              "rev-parse",
+              "--verify",
+              "--end-of-options",
+              `${localRef}^{object}`,
+            ],
+            cwd
+          ) === after
+        );
+      } catch {
+        return false;
+      }
+    };
+    if (!validRef(remoteRef) || !validSource())
+      throw new HistorySecretError(
+        "Malformed ref record. Supply the original Git pre-push stream with valid refs."
+      );
+    return { before, after };
+  });
+};
+
+/** Events carry actual IDs, never a guessed checkout HEAD. */
+export const eventPairs = (event, name, width) => {
+  if (name === "pull_request")
+    return [
+      {
+        before: event.pull_request?.base?.sha,
+        after: event.pull_request?.head?.sha,
+      },
+    ];
+  if (name === "push") {
+    const oid = new RegExp(`^[a-f0-9]{${width}}$`, "u");
+    if (!oid.test(event.before ?? "") || !oid.test(event.after ?? ""))
+      throw new HistorySecretError(
+        "Malformed event object IDs. Supply full actual before/after IDs matching the repository object format."
+      );
+    if (event.deleted === true && event.after !== "0".repeat(width))
+      throw new HistorySecretError(
+        "Inconsistent deletion event. Supply the original actual push event with a zero after ID for deletion."
+      );
+    return [{ before: event.before, after: event.after }];
+  }
+  throw new HistorySecretError(
+    "Unsupported CI event. Supply actual pull_request base/head or push before/after event data."
+  );
+};
+
+/** Pairwise subtraction prevents one ref's old tip from hiding another update. */
+export const introducedCommits = (pairs, cwd, width) => {
+  const oid = new RegExp(`^[a-f0-9]{${width}}$`, "u");
+  for (const pair of pairs) {
+    if (!oid.test(pair.before ?? "") || !oid.test(pair.after ?? ""))
+      throw new HistorySecretError(
+        "Malformed event object IDs. Supply full actual before/base/head IDs matching the repository object format."
+      );
+  }
+  const updates = pairs.filter(pair => !/^0+$/u.test(pair.after));
+  if (updates.length === 0) return [];
+  if (gitRead(["rev-parse", "--is-shallow-repository"], cwd) !== "false")
+    throw new HistorySecretError(
+      "Incomplete shallow history. Fetch complete required history (unshallow the checkout) and actual before/head objects before retrying."
+    );
+  const metadata = gitRead(["rev-parse", "--absolute-git-dir"], cwd);
+  if (
+    existsSync(join(metadata, "info/grafts")) &&
+    readFileSync(join(metadata, "info/grafts"), "utf8").trim()
+  )
+    throw new HistorySecretError(
+      "Legacy Git grafts prevent complete history proof. Use an unmodified complete repository checkout."
+    );
+  const commits = new Set();
+  for (const { before, after } of updates) {
+    const next = gitRead(["rev-parse", "--verify", `${after}^{commit}`], cwd);
+    const previous = /^0+$/u.test(before)
+      ? null
+      : gitRead(["rev-parse", "--verify", `${before}^{commit}`], cwd);
+    for (const tip of [next, previous].filter(Boolean)) {
+      const objects = gitRead(
+        ["rev-list", "--objects", "--missing=print", tip],
+        cwd
+      );
+      if (objects.split("\n").some(line => line.startsWith("?")))
+        throw new HistorySecretError(
+          "Required Git trees or blobs are missing. Fetch complete objects, repair the checkout and retry."
+        );
+    }
+    const list = gitRead(
+      ["rev-list", next, ...(previous ? [`^${previous}`] : [])],
+      cwd
+    );
+    for (const commit of list.split("\n").filter(Boolean)) commits.add(commit);
+  }
+  return [...commits].sort((left, right) =>
+    left < right ? -1 : left > right ? 1 : 0
+  );
+};
+
+/** Git's negotiated storage format determines accepted IDs. */
+export const objectWidth = cwd => {
+  const format = gitRead(["rev-parse", "--show-object-format"], cwd);
+  if (format === "sha1") return 40;
+  if (format === "sha256") return 64;
+  throw new HistorySecretError(
+    "Unsupported Git object format. Use a supported SHA-1 or SHA-256 checkout."
+  );
+};

package/all/copy-overwrite/scripts/lib/history-secret-policy.mjs

@@ -0,0 +1,39 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/**
+ * @file history-secret-policy.mjs
+ * @description Resolve only this owned facade without changing unrelated declarations.
+ * @module history-secrets
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { readGates, projectScripts, resolveMoment } from "../lisa-gates.mjs";
+import { HistorySecretError } from "./history-secret-git.mjs";
+export const HISTORY_PROPERTY = "introduced-history-credential-leakage";
+/** Unknown or malformed manifests cannot manufacture a required facade pass. */
+export const historyPolicy = (cwd, moment) => {
+  try {
+    if (existsSync(join(cwd, "package.json")))
+      JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+    const { gates, runner } = readGates(cwd);
+    const policy = resolveMoment({
+      gates,
+      runner,
+      scripts: projectScripts(cwd),
+      moment,
+      includeOff: true,
+    }).find(entry => entry.id === HISTORY_PROPERTY);
+    if (!policy || policy.level === "off") return null;
+    if (policy.level !== "required" || policy.mode !== "builtin")
+      throw new HistorySecretError(
+        "The authored required history route is incompatible. Run full Lisa apply and review its required managed facade declaration."
+      );
+    return policy;
+  } catch (error) {
+    if (error instanceof HistorySecretError) throw error;
+    throw new HistorySecretError(
+      "Required history policy could not be resolved. Repair project JSON and run full Lisa apply; raw configuration errors are withheld."
+    );
+  }
+};

package/all/copy-overwrite/scripts/lib/history-secret-scanner.mjs

@@ -0,0 +1,353 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/**
+ * @file history-secret-scanner.mjs
+ * @description Pin offline scanner identity and contain all scanner output.
+ * @module history-secrets
+ */
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  chmodSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { delimiter, join, resolve } from "node:path";
+import {
+  gitEnvironment,
+  gitRead,
+  HistorySecretError,
+} from "./history-secret-git.mjs";
+
+export const VERSION = "8.30.1";
+/** Archive and extracted executable pins both come from the same official release. */
+export const PINS = Object.freeze({
+  darwin_arm64: {
+    archive: "b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5",
+    binary: "ba52fb1bfabbcde42f032afad3d6e0b19dff8ed105229a16e7caa338bbc0e84f",
+  },
+  darwin_x64: {
+    archive: "dfe101a4db2255fc85120ac7f3d25e4342c3c20cf749f2c20a18081af1952709",
+    binary: "cee01fea7173f1b779dff188e1c26ecbcb4027d394acc573b23aaf0be260e291",
+  },
+  linux_x64: {
+    archive: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb",
+    binary: "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
+  },
+  linux_arm64: {
+    archive: "e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080",
+    binary: "00e91bbe655bd7c47753e8cfe61cb76ea1a5d7e7702fe161ee40102b46b3823b",
+  },
+});
+const digest = bytes => createHash("sha256").update(bytes).digest("hex");
+const shellQuote = value => `'${value.replaceAll("'", "'\\''")}'`;
+
+/** Audit the actual vendor Git children: Gitleaks can swallow their failures. */
+const auditedGit = scratch => {
+  const environment = gitEnvironment();
+  const binary = (environment.PATH ?? "")
+    .split(delimiter)
+    .map(directory => resolve(directory || ".", "git"))
+    .find(candidate => {
+      try {
+        accessSync(candidate, constants.X_OK);
+        return statSync(candidate).isFile();
+      } catch {
+        return false;
+      }
+    });
+  if (!binary)
+    throw new HistorySecretError(
+      "Git is unavailable for scanner execution. Restore Git on PATH and retry; safety is unproved."
+    );
+  const directory = join(scratch, "audited-git");
+  mkdirSync(directory, { mode: 0o700 });
+  const record = join(directory, "status.jsonl");
+  writeFileSync(record, "", { mode: 0o600 });
+  const launcher = join(directory, "audit.mjs");
+  // Inherit streaming stdin/stdout/stderr. Only status is captured here; the
+  // parent contains vendor diagnostics. The child deadline precedes the
+  // vendor's 120-second deadline, which precedes the outer 130-second deadline.
+  writeFileSync(
+    launcher,
+    `import { spawn } from "node:child_process";
+import { appendFileSync } from "node:fs";
+const args = process.argv.slice(2);
+let failure = false;
+const child = spawn(${JSON.stringify(binary)}, args, {
+  stdio: "inherit", timeout: 110000, killSignal: "SIGKILL"
+});
+child.once("error", () => { failure = true; });
+child.once("close", (status, signal) => {
+  appendFileSync(${JSON.stringify(record)}, JSON.stringify({
+    log: args[0] === "-C" && args[2] === "log",
+    status, signal, failure
+  }) + "\\n", { mode: 0o600 });
+  process.exitCode = !failure && !signal && status === 0 ? 0 : 1;
+});
+`,
+    { mode: 0o600 }
+  );
+  writeFileSync(
+    join(directory, "git"),
+    `#!/bin/sh\nexec ${shellQuote(process.execPath)} ${shellQuote(launcher)} "$@"\n`,
+    { mode: 0o700 }
+  );
+  return {
+    environment: {
+      ...environment,
+      PATH: `${directory}${delimiter}${environment.PATH ?? ""}`,
+    },
+    begin: () => writeFileSync(record, "", { mode: 0o600 }),
+    succeeded: () => {
+      try {
+        const rows = readFileSync(record, "utf8")
+          .trim()
+          .split("\n")
+          .filter(Boolean)
+          .map(line => JSON.parse(line));
+        return (
+          rows.some(row => row.log === true) &&
+          rows.every(
+            row =>
+              row.status === 0 && row.signal === null && row.failure === false
+          )
+        );
+      } catch {
+        // probe-direction: fail-closed — unreadable or malformed audit denies
+        // scanner success because successful Git execution cannot be proved.
+        return false;
+      }
+    },
+  };
+};
+const pin = () => {
+  const selected = PINS[`${process.platform}_${process.arch}`];
+  if (!selected)
+    throw new HistorySecretError(
+      "Unsupported scanner platform. Use supported Linux/macOS x64/arm64 with pinned Gitleaks 8.30.1."
+    );
+  return selected;
+};
+
+/** Provisioning is explicit; scanning itself stays offline and fails missing tools. */
+export const provisionScanner = async destination => {
+  const selected = pin();
+  const archiveName = `gitleaks_${VERSION}_${process.platform}_${process.arch}.tar.gz`;
+  const response = await fetch(
+    `https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/${archiveName}`,
+    { signal: AbortSignal.timeout(120000) }
+  );
+  if (!response.ok)
+    throw new HistorySecretError(
+      "Pinned scanner download failed. Restore access to the official release and retry provisioning."
+    );
+  const bytes = Buffer.from(await response.arrayBuffer());
+  if (digest(bytes) !== selected.archive)
+    throw new HistorySecretError(
+      "Scanner archive checksum mismatch. Discard the download and restore the official pinned release."
+    );
+  const scratch = mkdtempSync(join(tmpdir(), "lisa-scanner-provision-"));
+  chmodSync(scratch, 0o700);
+  try {
+    const archive = join(scratch, "release.tar.gz");
+    writeFileSync(archive, bytes, { mode: 0o600 });
+    const extraction = spawnSync("tar", ["-xOf", archive, "gitleaks"], {
+      maxBuffer: 64 * 1024 * 1024,
+      timeout: 120000,
+    });
+    if (
+      extraction.error ||
+      extraction.status !== 0 ||
+      digest(extraction.stdout) !== selected.binary
+    )
+      throw new HistorySecretError(
+        "Pinned scanner extraction failed identity verification. Repair tar/provisioning and retry."
+      );
+    writeFileSync(destination, extraction.stdout, { mode: 0o700 });
+    chmodSync(destination, 0o700);
+    qualifyScanner(destination);
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+};
+
+/** A forged same-version executable cannot satisfy the required scanner identity. */
+export const qualifyScanner = requested => {
+  const binary = requested
+    ? resolve(requested)
+    : (process.env.PATH ?? "")
+        .split(delimiter)
+        .map(directory => join(directory, "gitleaks"))
+        .find(existsSync);
+  if (!binary)
+    throw new HistorySecretError(
+      "Gitleaks 8.30.1 is unavailable. Run node scripts/lisa-history-secrets.mjs provision <executable-path>, then put that executable on PATH or supply --scanner."
+    );
+  let bytes;
+  try {
+    bytes = readFileSync(binary);
+  } catch {
+    throw new HistorySecretError(
+      "Scanner executable is unreadable. Provision the pinned Gitleaks 8.30.1 executable and retry."
+    );
+  }
+  if (digest(bytes) !== pin().binary)
+    throw new HistorySecretError(
+      "Scanner executable checksum/version mismatch. Provision the official pinned Gitleaks 8.30.1 release; required scanning cannot use an unqualified executable."
+    );
+  const version = spawnSync(binary, ["version"], {
+    env: gitEnvironment(),
+    encoding: "utf8",
+    timeout: 10000,
+  });
+  if (
+    version.error ||
+    version.signal ||
+    version.status !== 0 ||
+    version.stdout.trim() !== VERSION
+  )
+    throw new HistorySecretError(
+      "Scanner version execution failed. Repair permissions and provision pinned Gitleaks 8.30.1."
+    );
+  return binary;
+};
+
+/** Only structured safe attribution is serialized, never stderr or metadata strings. */
+export const scanCommits = (commits, cwd, requested) => {
+  const binary = qualifyScanner(requested);
+  const scratch = mkdtempSync(join(tmpdir(), "lisa-history-scan-"));
+  chmodSync(scratch, 0o700);
+  try {
+    const scanner = join(scratch, "gitleaks");
+    const executable = readFileSync(binary);
+    if (digest(executable) !== pin().binary)
+      throw new HistorySecretError(
+        "Scanner identity changed during qualification. Provision the pinned executable and retry."
+      );
+    writeFileSync(scanner, executable, { mode: 0o700 });
+    const config = join(scratch, "default.toml");
+    const report = join(scratch, "report.json");
+    const ignore = join(scratch, "ignore");
+    writeFileSync(config, "[extend]\nuseDefault = true\n", { mode: 0o600 });
+    // Gitleaks truncates this existing file: its report keeps private mode even
+    // when the caller's umask would otherwise create world-readable metadata.
+    writeFileSync(report, "[]", { mode: 0o600 });
+    writeFileSync(ignore, "", { mode: 0o600 });
+    // An isolated bare view excludes caller ignore files even in Git metadata.
+    const source = join(scratch, "repository");
+    gitRead(
+      [
+        "init",
+        "--bare",
+        `--object-format=${gitRead(["rev-parse", "--show-object-format"], cwd)}`,
+        source,
+      ],
+      scratch
+    );
+    const objects = gitRead(
+      ["rev-parse", "--path-format=absolute", "--git-path", "objects"],
+      cwd
+    );
+    writeFileSync(join(source, "objects/info/alternates"), `${objects}\n`, {
+      mode: 0o600,
+    });
+    const findings = [];
+    const audit = auditedGit(scratch);
+    for (let offset = 0; offset < commits.length; offset += 100) {
+      const group = commits.slice(offset, offset + 100);
+      audit.begin();
+      const result = spawnSync(
+        scanner,
+        [
+          "git",
+          source,
+          "--config",
+          config,
+          "--gitleaks-ignore-path",
+          ignore,
+          "--ignore-gitleaks-allow",
+          "--redact=100",
+          "--no-banner",
+          "--no-color",
+          "--log-level",
+          "error",
+          "--platform",
+          "none",
+          "--exit-code",
+          "42",
+          "--timeout",
+          "120",
+          "--report-format",
+          "json",
+          "--report-path",
+          report,
+          "--log-opts",
+          `--no-walk=unsorted --root --diff-merges=separate --no-ext-diff --no-textconv --no-renames ${group.join(" ")}`,
+        ],
+        {
+          cwd: scratch,
+          env: audit.environment,
+          timeout: 130000,
+          maxBuffer: 16 * 1024 * 1024,
+        }
+      );
+      if (
+        result.error ||
+        result.signal ||
+        ![0, 42].includes(result.status) ||
+        result.stdout.length ||
+        result.stderr.length ||
+        !audit.succeeded()
+      )
+        throw new HistorySecretError(
+          "Gitleaks 8.30.1 execution/configuration failed. Repair the pinned scanner and complete Git objects; no safety result was established."
+        );
+      let rows;
+      try {
+        rows = JSON.parse(readFileSync(report, "utf8"));
+      } catch {
+        throw new HistorySecretError(
+          "Scanner report is missing or malformed. Repair pinned scanner execution and retry; safety is unproved."
+        );
+      }
+      if (!Array.isArray(rows) || (result.status === 42) !== rows.length > 0)
+        throw new HistorySecretError(
+          "Scanner exit/report disagreement. Repair pinned scanner execution; required safety is unproved."
+        );
+      for (const row of rows) {
+        if (
+          !group.includes(row.Commit) ||
+          !/^[a-z][a-z0-9-]{1,64}$/u.test(row.RuleID) ||
+          !Number.isSafeInteger(row.StartLine) ||
+          row.StartLine < 1
+        )
+          throw new HistorySecretError(
+            "Scanner attribution is invalid. Repair pinned scanner execution; no raw report is published."
+          );
+        findings.push({
+          rule: row.RuleID,
+          commit: row.Commit,
+          line: row.StartLine,
+        });
+      }
+    }
+    return {
+      scanner: "Gitleaks",
+      version: VERSION,
+      commits: commits.length,
+      findings,
+    };
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+};

package/all/copy-overwrite/scripts/lisa-gates.mjs

@@ -876,6 +876,18 @@ export const REGISTRY = Object.freeze({
       "Proved by the gitleaks binary in the pre-commit built-in and by a hosted scanner in CI. Neither is a package script.",
     moments: COMMIT_ONWARD,
   },
+  "introduced-history-credential-leakage": {
+    label: "🔐 Introduced History Credential Leakage",
+    summary:
+      "Every actual introduced Git history range is scanner-clean and fully redacted.",
+    task: "security:check-introduced-history",
+    declareOnly:
+      "When declared, the emitted scripts/lisa-history-secrets.mjs proves the actual range with a pinned offline scanner, without a package script.",
+    ownedFacadeAt: [PUSH, PULL_REQUEST],
+    needs: NO_INSTALL,
+    moments: [PUSH, PULL_REQUEST],
+    work: "introduced commits scanned",
+  },
   "dependency-vulnerability": {
     label: "🔒 Security Scan",
     summary: "No known high or critical advisory in shipped dependencies.",
@@ -1091,6 +1103,7 @@ export const REGISTRY = Object.freeze({
  * the two disagree, which is what keeps a static copy true.
  */
 export const QUALITY_JOB_GATES = Object.freeze({
+  history_secrets: "introduced-history-credential-leakage",
   lint: CODE_STYLE,
   lint_slow: "code-style-slow",
   typecheck: "type-correctness",
@@ -3123,6 +3136,7 @@ export const REUSE_CLASSES = Object.freeze(Object.values(REUSE_CLASS));
  * A project overrides a row with `gates.<id>.reuse` in `.lisa.config.json`.
  */
 export const GATE_REUSE_CLASS = Object.freeze({
+  "introduced-history-credential-leakage": { class: REUSE_CLASS.NEVER },
   accessibility: { class: REUSE_CLASS.NEVER },
   // A guard whose job is to detect a stale generated artifact must not itself
   // be satisfied by a record of a previous run, and it costs seconds.
@@ -5441,16 +5455,18 @@ export function resolveMoment({
       declared === null &&
       definition?.declareOnly !== undefined &&
       definition?.shippedAs === undefined &&
-      scripts !== null &&
-      typeof scripts === "object" &&
-      !Object.hasOwn(scripts, task) &&
-      HARDCODED_INVOCATIONS.some(
-        invocation =>
-          invocation.gate === id &&
-          invocation.moment === moment &&
-          invocation.facade === CONSULTS_THEN_FALLS_BACK &&
-          invocation.unconditional === true
-      );
+      ((scripts !== null &&
+        typeof scripts === "object" &&
+        !Object.hasOwn(scripts, task)) ||
+        (id === "introduced-history-credential-leakage" && scripts === null)) &&
+      (definition?.ownedFacadeAt?.includes(moment) ||
+        HARDCODED_INVOCATIONS.some(
+          invocation =>
+            invocation.gate === id &&
+            invocation.moment === moment &&
+            invocation.facade === CONSULTS_THEN_FALLS_BACK &&
+            invocation.unconditional === true
+        ));
 
     resolved.push({
       id,