@codyswann/lisa 4.70.1 → 4.70.3

package/README.md

@@ -259,6 +259,24 @@ servers, or configuration. Other harnesses retain their existing delivery
 behavior. For a new project, run the CLI ephemerally with
 `bunx @codyswann/lisa setup-project ...`.
 
+Entire session capture is host-owned opt-in. Lisa's Rails settings and base
+Claude plugin register no Entire commands. Full apply also removes the seven
+exact automatic command strings shipped by older Lisa releases, because an
+array-union merge cannot retire installed entries by itself. Other hooks and
+settings survive, and Lisa does not inspect or delete existing session data.
+This does not change user/global settings or registrations owned by other
+plugins.
+
+To opt in, review capture, retention, and access first, then create a host-owned
+wrapper such as `scripts/private-session-hooks.sh`. Register its distinct
+command in Claude's project hook settings, for example
+`bash "$CLAUDE_PROJECT_DIR/scripts/private-session-hooks.sh" session-start`.
+Lisa preserves that wrapper on reapply. Reusing an exact retired Lisa command
+does not establish host ownership and the migration will remove it. Keep the
+Lisa governance hooks enabled; no Entire configuration flag is required or
+interpreted by Lisa. Start a fresh session after updating the installed plugin
+so it loads the current registrations.
+
 Successful starter creation records the repository, tracked branch and copied
 revision in `starter.templates`. Git clones record their own head before setup
 replaces the clone history; GitHub template creation checks the copied tree

package/all/copy-overwrite/scripts/lib/history-secret-scanner.mjs

@@ -222,6 +222,301 @@ export const qualifyScanner = requested => {
   return binary;
 };
 
+const EVIDENCE_BUDGET = 64 * 1024 * 1024;
+const NO_REPLACEMENTS = "--no-replace-objects";
+const TAXONOMY = "Disk/missing/corrupt";
+const NARRATIVE = [
+  "AccessDenied boundaries,",
+  `${TAXONOMY} falsifications.`,
+].join(" ");
+const safePath = value =>
+  typeof value === "string" &&
+  value.length > 0 &&
+  !/[\\\u0000-\u001f\u007f]/u.test(value) &&
+  !/^(?:\/|[A-Za-z]:)/u.test(value) &&
+  value.split("/").every(part => part && part !== "." && part !== "..");
+
+/** Read authentic regular Git blobs, never trimmed text or worktree evidence. */
+const readBlob = (file, commit, cwd, budget) => {
+  if (!safePath(file)) return null;
+  const entries = gitRead(
+    ["--literal-pathspecs", "ls-tree", "-z", commit, "--", file],
+    cwd
+  )
+    .split("\0")
+    .filter(Boolean);
+  if (entries.length !== 1) return null;
+  const entry = entries[0].match(
+    /^(100644|100755) blob ([a-f0-9]{40}|[a-f0-9]{64})\t([\s\S]*)$/u
+  );
+  if (!entry || entry[3] !== file || entry[2].length !== commit.length)
+    return null;
+  const sizeText = gitRead(["cat-file", "-s", entry[2]], cwd);
+  const size = Number(sizeText);
+  if (!/^\d+$/u.test(sizeText) || !Number.isSafeInteger(size))
+    throw new HistorySecretError(
+      "Git blob size is invalid. Repair complete Git objects and retry; safety is unproved."
+    );
+  if (size > budget.remaining) return null;
+  const result = spawnSync(
+    "git",
+    [NO_REPLACEMENTS, "cat-file", "blob", entry[2]],
+    {
+      cwd,
+      env: gitEnvironment(),
+      timeout: 120000,
+      maxBuffer: EVIDENCE_BUDGET,
+    }
+  );
+  if (
+    result.error ||
+    result.signal ||
+    result.status !== 0 ||
+    result.stdout.length !== size ||
+    createHash(commit.length === 40 ? "sha1" : "sha256")
+      .update(`blob ${size}\0`)
+      .update(result.stdout)
+      .digest("hex") !== entry[2]
+  )
+    throw new HistorySecretError(
+      "Git blob bytes cannot be verified. Repair complete Git objects and retry; no raw source is published."
+    );
+  budget.remaining -= size;
+  return result.stdout;
+};
+
+/** Native JSON validation plus bounded duplicate-aware lexical role attribution. */
+const evidenceMap = bytes => {
+  if (bytes.length > 1024 * 1024) return null;
+  const text = bytes.toString("utf8");
+  if (!Buffer.from(text).equals(bytes)) return null;
+  try {
+    const value = JSON.parse(text);
+    if (
+      !value ||
+      typeof value !== "object" ||
+      Array.isArray(value) ||
+      !value.source_sha256 ||
+      typeof value.source_sha256 !== "object" ||
+      Array.isArray(value.source_sha256)
+    )
+      return null;
+    const entries = Object.entries(value.source_sha256);
+    if (
+      !entries.length ||
+      entries.length > 256 ||
+      entries.some(
+        ([file, hash]) =>
+          !safePath(file) ||
+          typeof hash !== "string" ||
+          !/^[a-f0-9]{64}$/u.test(hash)
+      )
+    )
+      return null;
+    const tokens = [
+      ...text.matchAll(/"(?:\\[\s\S]|[^"\\])*"|[{}[\],:]|[^{}[\],:\s]+/gu),
+    ];
+    if (tokens.length > 8192) return null;
+    let cursor = 0;
+    const spans = [];
+    const visit = (path, depth) => {
+      if (depth > 32) throw new Error("Bounded JSON depth");
+      const token = tokens[cursor++];
+      if (token[0] === "{") {
+        const keys = new Set();
+        while (tokens[cursor][0] !== "}") {
+          const key = JSON.parse(tokens[cursor++][0]);
+          if (keys.has(key)) throw new Error("Duplicate decoded JSON key");
+          keys.add(key);
+          cursor++; // Native JSON validation already proved the colon.
+          visit([...path, key], depth + 1);
+          if (tokens[cursor][0] === ",") cursor++;
+        }
+        cursor++;
+      } else if (token[0] === "[") {
+        let index = 0;
+        while (tokens[cursor][0] !== "]") {
+          visit([...path, index++], depth + 1);
+          if (tokens[cursor][0] === ",") cursor++;
+        }
+        cursor++;
+      } else if (
+        path.length === 2 &&
+        path[0] === "source_sha256" &&
+        token[0][0] === '"'
+      ) {
+        const hash = JSON.parse(token[0]);
+        // Escaped values do not supply an unambiguous literal detector span.
+        if (token[0] !== JSON.stringify(hash))
+          throw new Error("Ambiguous digest spelling");
+        spans.push({
+          file: path[1],
+          hash,
+          start: Buffer.byteLength(text.slice(0, token.index + 1)),
+          end: Buffer.byteLength(
+            text.slice(0, token.index + token[0].length - 1)
+          ),
+        });
+      }
+    };
+    visit([], 0);
+    return cursor === tokens.length && spans.length === entries.length
+      ? { value, spans }
+      : null;
+  } catch {
+    // probe-direction: fail-closed — malformed, duplicate or over-budget JSON
+    // cannot establish evidence role; its detector findings remain blocking.
+    return null;
+  }
+};
+
+/** Clear only a uniquely attributed, independently established benign finding. */
+const classifyEvidence = cwd => {
+  const budget = { remaining: EVIDENCE_BUDGET };
+  const blobs = new Map();
+  const maps = new Map();
+  const blob = (file, commit) => {
+    const key = `${commit}\0${file}`;
+    if (!blobs.has(key)) {
+      if (blobs.size >= 256) return null;
+      blobs.set(key, readBlob(file, commit, cwd, budget));
+    }
+    return blobs.get(key);
+  };
+  return row => {
+    if (
+      row.RuleID !== "generic-api-key" ||
+      !safePath(row.File) ||
+      row.SymlinkFile !== "" ||
+      row.Secret !== "REDACTED" ||
+      typeof row.Match !== "string" ||
+      row.EndLine !== row.StartLine ||
+      !Number.isSafeInteger(row.StartColumn) ||
+      !Number.isSafeInteger(row.EndColumn) ||
+      row.StartColumn < 1 ||
+      row.EndColumn < row.StartColumn
+    )
+      return false;
+    const bytes = blob(row.File, row.Commit);
+    if (!bytes) return false;
+    let lineStart = 0;
+    for (let line = 1; line < row.StartLine; line++) {
+      const next = bytes.indexOf(10, lineStart);
+      if (next < 0) return false;
+      lineStart = next + 1;
+    }
+    const newline = bytes.indexOf(10, lineStart);
+    const lineEnd = newline < 0 ? bytes.length : newline;
+    const replacements = row.Match.split("REDACTED");
+    if (replacements.length !== 2) return false;
+    const line = bytes.subarray(lineStart, lineEnd);
+    const attributed = (candidate, left, right) => {
+      const template = replacements.join(candidate);
+      if (template.split(candidate).length !== 2) return false;
+      const original = Buffer.from(template);
+      const offset = line.indexOf(original);
+      if (offset < 0 || line.indexOf(original, offset + 1) >= 0) return false;
+      const start = lineStart + offset;
+      const end = start + original.length;
+      if (
+        left !== start + Buffer.byteLength(replacements[0]) ||
+        right !== left + Buffer.byteLength(candidate)
+      )
+        return false;
+      // Pinned 8.30.1 detect/location.go counts a preceding fragment newline
+      // in columns after its first line. Prove exactly one of those two byte
+      // frames against the actual unique Git span; never infer fragment state.
+      return (
+        [0, 1].filter(
+          newlineByte =>
+            start === lineStart + row.StartColumn - 1 - newlineByte &&
+            end === lineStart + row.EndColumn - newlineByte
+        ).length === 1
+      );
+    };
+    // A complete standalone validation paragraph excludes surrounding JSON,
+    // assignments and interpolated/code contexts, not merely their filenames.
+    if (
+      (bytes.equals(Buffer.from(NARRATIVE)) ||
+        bytes.equals(Buffer.from(`${NARRATIVE}\n`))) &&
+      attributed(
+        TAXONOMY,
+        NARRATIVE.indexOf(TAXONOMY),
+        NARRATIVE.indexOf(TAXONOMY) + TAXONOMY.length
+      )
+    )
+      return true;
+    const key = `${row.Commit}\0${row.File}`;
+    if (!maps.has(key)) {
+      const parsed = evidenceMap(bytes);
+      let valid = parsed !== null;
+      const revision =
+        parsed && Object.hasOwn(parsed.value, "source_revision")
+          ? parsed.value.source_revision
+          : row.Commit;
+      if (parsed && Object.hasOwn(parsed.value, "source_revision")) {
+        valid =
+          typeof revision === "string" &&
+          new RegExp(`^[a-f0-9]{${row.Commit.length}}$`, "u").test(revision);
+        if (valid) {
+          const type = spawnSync(
+            "git",
+            [NO_REPLACEMENTS, "cat-file", "-t", revision],
+            {
+              cwd,
+              env: gitEnvironment(),
+              timeout: 120000,
+              maxBuffer: 1024 * 1024,
+            }
+          );
+          const ancestry = spawnSync(
+            "git",
+            [
+              NO_REPLACEMENTS,
+              "merge-base",
+              "--is-ancestor",
+              revision,
+              row.Commit,
+            ],
+            {
+              cwd,
+              env: gitEnvironment(),
+              timeout: 120000,
+              maxBuffer: 1024 * 1024,
+            }
+          );
+          // probe-direction: fail-closed — an absent/unreachable revision or
+          // failed ancestry probe cannot establish a historical preimage.
+          valid =
+            !type.error &&
+            !type.signal &&
+            type.status === 0 &&
+            type.stdout.toString() === "commit\n" &&
+            !type.stderr.length &&
+            !ancestry.error &&
+            !ancestry.signal &&
+            ancestry.status === 0 &&
+            !ancestry.stdout.length &&
+            !ancestry.stderr.length;
+        }
+      }
+      if (valid)
+        for (const span of parsed.spans) {
+          const sourceBytes = blob(span.file, revision);
+          if (!sourceBytes || digest(sourceBytes) !== span.hash) {
+            valid = false;
+            break;
+          }
+        }
+      maps.set(key, valid ? parsed.spans : []);
+    }
+    const candidates = maps
+      .get(key)
+      .filter(span => attributed(span.hash, span.start, span.end));
+    return candidates.length === 1;
+  };
+};
+
 /** Only structured safe attribution is serialized, never stderr or metadata strings. */
 export const scanCommits = (commits, cwd, requested) => {
   const binary = qualifyScanner(requested);
@@ -263,6 +558,7 @@ export const scanCommits = (commits, cwd, requested) => {
     });
     const findings = [];
     const audit = auditedGit(scratch);
+    const benign = classifyEvidence(cwd);
     for (let offset = 0; offset < commits.length; offset += 100) {
       const group = commits.slice(offset, offset + 100);
       audit.begin();
@@ -334,11 +630,12 @@ export const scanCommits = (commits, cwd, requested) => {
           throw new HistorySecretError(
             "Scanner attribution is invalid. Repair pinned scanner execution; no raw report is published."
           );
-        findings.push({
-          rule: row.RuleID,
-          commit: row.Commit,
-          line: row.StartLine,
-        });
+        if (!benign(row))
+          findings.push({
+            rule: row.RuleID,
+            commit: row.Commit,
+            line: row.StartLine,
+          });
       }
     }
     return {

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -1077,11 +1077,36 @@ function trackerContract(config = readConfig()) {
   );
 }
 
+/**
+ * Resolve authored references before any binding or provider decision.
+ *
+ * The literal `github/` namespace is an identity spelling, not a different
+ * tracker or an exemption. Its ASCII segments must survive unchanged; URL
+ * parsing or path normalization would incorrectly admit encoded/dot paths.
+ * @param {unknown} raw Authored work-item reference.
+ * @param {object} contract Existing configured tracker contract.
+ * @returns {string} Repository-scoped canonical identity.
+ */
 function canonicalizeRef(raw, contract = trackerContract()) {
   const value = String(raw ?? "").trim();
   if (contract.provider === "github") {
-    const match = /^([^\s/#]+\/[^\s/#]+)#([1-9]\d*)$/.exec(value);
-    if (!match)
+    const qualified =
+      /^github\/([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)#([1-9]\d*)$/.exec(value);
+    // Match authored URL bytes before normalization: URL parsers can erase a
+    // port or decode a path that this input contract deliberately refuses.
+    const match =
+      qualified ??
+      /^([^\s/#]+\/[^\s/#]+)#([1-9]\d*)$/.exec(value) ??
+      /^https:\/\/github\.com\/([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)\/issues\/([1-9]\d*)$/.exec(
+        value
+      );
+    if (
+      !match ||
+      (qualified &&
+        qualified[1]
+          .split("/")
+          .some(segment => segment === "." || segment === ".."))
+    )
       throw new TrackingError(
         `Invalid GitHub Work-Item '${value}'; expected owner/repo#123`
       );
@@ -1438,6 +1463,18 @@ export function soleWorkItem(text, contract, subject) {
   const refs = [
     ...new Set(values.map(value => canonicalizeRef(value, contract))),
   ];
+  // Canonical repeats (including repository case variants) retain their
+  // meaning. Mixing the URL and canonical representations is two authored
+  // declarations even when normalization would collapse their identity.
+  if (
+    contract.provider === "github" &&
+    values.some(value => value.startsWith("https://github.com/")) &&
+    values.some(value => !value.startsWith("https://github.com/"))
+  ) {
+    throw new TrackingError(
+      `${subject[0].toUpperCase()}${subject.slice(1)} mixes URL and canonical Work-Item declarations; it must name exactly one`
+    );
+  }
   if (refs.length > 1) {
     throw new TrackingError(
       `${subject[0].toUpperCase()}${subject.slice(1)} names ${refs.length} different work items (${refs.join(", ")}); it must name exactly one`
@@ -3526,7 +3563,24 @@ function prWorkItems(body, contract) {
     throw new TrackingError(
       "No Work-Item trailer anywhere in the pull request body"
     );
-  return [...new Set(values.map(value => canonicalizeRef(value, contract)))];
+  const declared = values.map(value => ({
+    value,
+    ref: canonicalizeRef(value, contract),
+  }));
+  // Validation precedes representation checks; canonical GitHub refs lack ://.
+  const urlRefs = new Set(
+    declared.filter(({ value }) => value.includes("://")).map(({ ref }) => ref)
+  );
+  if (
+    contract.provider === "github" &&
+    declared.some(
+      ({ value, ref }) => !value.includes("://") && urlRefs.has(ref)
+    )
+  )
+    throw new TrackingError(
+      "Pull request body mixes URL and canonical Work-Item declarations for the same work item"
+    );
+  return [...new Set(declared.map(({ ref }) => ref))];
 }
 
 /**
@@ -4507,6 +4561,10 @@ function backlink(args) {
  * repository does the commit declare? — and a value the filter drops is one the
  * reader still saw. That ordering is what keeps a malformed trailer refusable
  * by the gate instead of invisible to it.
+ * Qualified `github/owner/name#number` values use the SAME canonical resolver
+ * as the gates, so the audit does not lose attribution accepted by a hook.
+ * This audit still requires a hash-number declaration; supported issue URLs
+ * remain a gate input, not a newly admitted audit declaration.
  *
  * CRLF needs nothing here, and a relayed review finding that said otherwise
  * was refuted rather than acted on. `workItemLines` splits on `/\r?\n/`, so a
@@ -4518,16 +4576,19 @@ function backlink(args) {
  * @returns {number[]} Declared issue numbers, de-duplicated, in first-seen order.
  */
 export function declaredWorkItemNumbers(body, repository) {
-  const owner = String(repository ?? "").toLowerCase();
+  const owner = String(repository ?? "");
   if (owner === "") return [];
+  const contract = { provider: "github", repository: owner };
   const numbers = [];
   for (const value of workItemLines(body)) {
-    const hash = value.indexOf("#");
-    if (hash === -1) continue;
-    if (value.slice(0, hash).toLowerCase() !== owner) continue;
-    const digits = value.slice(hash + 1);
-    if (!isIssueNumber(digits)) continue;
-    numbers.push(Number(digits));
+    if (!value.includes("#")) continue;
+    try {
+      const ref = canonicalizeRef(value, contract);
+      const digits = ref.slice(ref.indexOf("#") + 1);
+      if (isIssueNumber(digits)) numbers.push(Number(digits));
+    } catch (error) {
+      if (!(error instanceof TrackingError)) throw error;
+    }
   }
   return [...new Set(numbers)];
 }

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAi7CjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAo1CjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAy7CjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA41CjC,CAAC"}

package/dist/core/lisa-owned-hash-ledger.js

@@ -456,8 +456,11 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "ca75ebbc45fca4c52400612ae818d231a28289b50a70f6cdee6feb51b144896f",
     ]),
     "scripts/lib/history-secret-scanner.mjs": Object.freeze([
+        "223cc0e59b19b60e0e78a8a85710cab634ef90cd4661b5a5d608455afbf9c4c4",
         "501452c19be923616a6ea1ed9443c86cbac14e4aa3073e579f6af82d1423a2c9",
         "6afcb5ea42d8f9046a17e2253d4ddbefdf9025b150870afda23db77796f05f25",
+        "a68a4ba784699c470e1525ed3cd2f31f399cc80472d2bf5653d936bf3252c658",
+        "fc2677b9f5ae86ee9709bb59f1e9cf231f258d12ddcfbf9a6dd9a711155220d2",
         "ff90535b7c6f24f48651ab93d204a1530c6bfaa8e6169d3aa83ab069c1a1ef22",
     ]),
     "scripts/lib/invoked-as-script.mjs": Object.freeze([
@@ -1224,6 +1227,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "04f78df45465d01601c8b5711b74749b2a2c2b70b9c916d6790bd69e1c11865d",
         "06f82a176755c7ff464e263c8a0a6249e02bed710504acf1129ff8fc4c2c0326",
         "08ec9a37d66fb35443a5aac72e09d7ab5478cbd516f72e248d01b3befabddfe5",
+        "0a9d388ac78181e23aa4a23d6b2e9af04b30f204f39a0378a5bbd60612d907ce",
         "0b6eff0a306ccd8396d6e3d71ac9c54d3a1c8c29449a9146e0c2e5726b74feb9",
         "0fdec8bbfb55e97e9caa91441c8306b0f7d0b9a8957b80ce68fbe98346e0d63e",
         "10b9e0e2db549609fb4ab66ebe9b4f755bf7f6cc6be606f1a3515f5ebe6d5110",
@@ -1239,6 +1243,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "23b58ea56cb26fbdef204d7bdbc4f18fe097947d64f733381823e900a30ea70c",
         "250d44a7a862e59cbbc35f66e8dd28e68c9a9df7cd1c27c547b3aadadc2b5956",
         "275b4d773ecefeeceee972191086cffaa159a4cb3cac2dae3d85dfd363c69fb6",
+        "2a7528b1362a5e73c01874d5dd915f030f023c12621bfe87830295480baaa8e8",
         "2b7e81f0e23628da9c3a124f3d5b0593e3a8c564cd595329b9f37510540a5581",
         "2c678c75d6de9b029f27fa6eec45b8421217a4fb5ef3412ad39883e10b213987",
         "2cd876ccf562b8c2b146817f80ebc189f9e31989457067c14938ed5e745a94b9",
@@ -1255,6 +1260,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "42176fa5ee6df11d2337a91b2eeeb31a9ed7cc1e16acb0cec11739ba5a6849ed",
         "4372872a448d3b943dea5541167ed5be6155703b57b9f8224d19ddefd3b80898",
         "475cb9ef86c2ac54c8fd8cb6d63e9a55ea8cd0017e26efbe3c44391a4aeeab41",
+        "47677cf8b388e62fc82efdf564f94a784499f23b7f290ee1d7f9f50cc8a8abc3",
         "4ae4e4e25c5fc075824a112a26abae6ab157c2888332c376db928b51530abc0a",
         "4c263fef48c03b3b6c623ea8a6cd55505bfaf28197e5072226ea35f9f3d26885",
         "4d054e3b7a266d69108f7cec12ee02e6a302670ff5932dc398cb0c5069b2a44f",
@@ -1282,6 +1288,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "6afe796f5a69a68a026c79a64aa451eb2bf7907a0ace0d9079f8b4add16b886b",
         "6ced6d3929f58e0b0b3e12717af537f9c4f57ad03c18d99e774026c169b13874",
         "6dadc065016e741568b6ae1ebcd0378085005c076fdb93346bad7c1fd9e3b8b8",
+        "6ec811517f212f6e6b33a8163f16a6b0538731c9cbe626e9f62a55b0f0af9518",
         "7156449f0ad8c68c40c3f7f02df91248e32d9d83a439b38c4ce0a3fd35e04c1e",
         "71fcbf510d3ac112417cea1bd0b4fd4b478e7f01a51f04b6a28fb7a487443d36",
         "71ff42c2cb8ac7022e0066132476764dd745fb92bf19ccd395000b1fe319abc7",
@@ -1345,6 +1352,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "e41e9534988ce69a836664437a78f3a3f3dc7ebbe396c86cdab0ea63fb7c19da",
         "e5e7d4322195d0e675fd62a8630cefa811d2459cea752163787d01cfa65e5ed7",
         "e80c460034868c7e4152dd4276881105f80b3b76f4f130bff1ab662e17a9cb5a",
+        "e94675ad68dd4254ad96fb1f2f67eb58447d4eb4f04475200d449f4932c78824",
         "ea63f5b9e02ed081e21bebd928e77b3f7315addd2b8001112cb423eea459cd5f",
         "ea82b8b47c8367fc732ed8c70ba2cbf882aa01b40e40d40a95c5874044206815",
         "ec2aa4c645fb1573aa2dfb731e7ced02a00b7f56a3eb853157ac7e74c0a04f92",
@@ -1907,8 +1915,11 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "ca75ebbc45fca4c52400612ae818d231a28289b50a70f6cdee6feb51b144896f",
     ]),
     "scripts/lib/history-secret-scanner.mjs": Object.freeze([
+        "223cc0e59b19b60e0e78a8a85710cab634ef90cd4661b5a5d608455afbf9c4c4",
         "501452c19be923616a6ea1ed9443c86cbac14e4aa3073e579f6af82d1423a2c9",
         "6afcb5ea42d8f9046a17e2253d4ddbefdf9025b150870afda23db77796f05f25",
+        "a68a4ba784699c470e1525ed3cd2f31f399cc80472d2bf5653d936bf3252c658",
+        "fc2677b9f5ae86ee9709bb59f1e9cf231f258d12ddcfbf9a6dd9a711155220d2",
         "ff90535b7c6f24f48651ab93d204a1530c6bfaa8e6169d3aa83ab069c1a1ef22",
     ]),
     "scripts/lib/invoked-as-script.mjs": Object.freeze([
@@ -2607,6 +2618,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "04401ae05bf9464e6929180ffdfff80afc528a1df20733b032a0342252ca1d4a",
         "06f82a176755c7ff464e263c8a0a6249e02bed710504acf1129ff8fc4c2c0326",
         "08ec9a37d66fb35443a5aac72e09d7ab5478cbd516f72e248d01b3befabddfe5",
+        "0a9d388ac78181e23aa4a23d6b2e9af04b30f204f39a0378a5bbd60612d907ce",
         "0b6eff0a306ccd8396d6e3d71ac9c54d3a1c8c29449a9146e0c2e5726b74feb9",
         "0fdec8bbfb55e97e9caa91441c8306b0f7d0b9a8957b80ce68fbe98346e0d63e",
         "10b9e0e2db549609fb4ab66ebe9b4f755bf7f6cc6be606f1a3515f5ebe6d5110",
@@ -2622,6 +2634,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "23b58ea56cb26fbdef204d7bdbc4f18fe097947d64f733381823e900a30ea70c",
         "250d44a7a862e59cbbc35f66e8dd28e68c9a9df7cd1c27c547b3aadadc2b5956",
         "275b4d773ecefeeceee972191086cffaa159a4cb3cac2dae3d85dfd363c69fb6",
+        "2a7528b1362a5e73c01874d5dd915f030f023c12621bfe87830295480baaa8e8",
         "2b7e81f0e23628da9c3a124f3d5b0593e3a8c564cd595329b9f37510540a5581",
         "2c678c75d6de9b029f27fa6eec45b8421217a4fb5ef3412ad39883e10b213987",
         "2cd876ccf562b8c2b146817f80ebc189f9e31989457067c14938ed5e745a94b9",
@@ -2638,6 +2651,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "42176fa5ee6df11d2337a91b2eeeb31a9ed7cc1e16acb0cec11739ba5a6849ed",
         "4372872a448d3b943dea5541167ed5be6155703b57b9f8224d19ddefd3b80898",
         "475cb9ef86c2ac54c8fd8cb6d63e9a55ea8cd0017e26efbe3c44391a4aeeab41",
+        "47677cf8b388e62fc82efdf564f94a784499f23b7f290ee1d7f9f50cc8a8abc3",
         "4ae4e4e25c5fc075824a112a26abae6ab157c2888332c376db928b51530abc0a",
         "4c263fef48c03b3b6c623ea8a6cd55505bfaf28197e5072226ea35f9f3d26885",
         "4d054e3b7a266d69108f7cec12ee02e6a302670ff5932dc398cb0c5069b2a44f",
@@ -2664,6 +2678,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "6afe796f5a69a68a026c79a64aa451eb2bf7907a0ace0d9079f8b4add16b886b",
         "6ced6d3929f58e0b0b3e12717af537f9c4f57ad03c18d99e774026c169b13874",
         "6dadc065016e741568b6ae1ebcd0378085005c076fdb93346bad7c1fd9e3b8b8",
+        "6ec811517f212f6e6b33a8163f16a6b0538731c9cbe626e9f62a55b0f0af9518",
         "7156449f0ad8c68c40c3f7f02df91248e32d9d83a439b38c4ce0a3fd35e04c1e",
         "71fcbf510d3ac112417cea1bd0b4fd4b478e7f01a51f04b6a28fb7a487443d36",
         "71ff42c2cb8ac7022e0066132476764dd745fb92bf19ccd395000b1fe319abc7",
@@ -2726,6 +2741,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "e41e9534988ce69a836664437a78f3a3f3dc7ebbe396c86cdab0ea63fb7c19da",
         "e5e7d4322195d0e675fd62a8630cefa811d2459cea752163787d01cfa65e5ed7",
         "e80c460034868c7e4152dd4276881105f80b3b76f4f130bff1ab662e17a9cb5a",
+        "e94675ad68dd4254ad96fb1f2f67eb58447d4eb4f04475200d449f4932c78824",
         "ea63f5b9e02ed081e21bebd928e77b3f7315addd2b8001112cb423eea459cd5f",
         "ea82b8b47c8367fc732ed8c70ba2cbf882aa01b40e40d40a95c5874044206815",
         "ec2aa4c645fb1573aa2dfb731e7ced02a00b7f56a3eb853157ac7e74c0a04f92",