@codyswann/lisa 4.70.2 → 4.70.4

package/all/copy-overwrite/scripts/lib/history-secret-scanner.mjs

@@ -27,6 +27,7 @@ import {
   gitRead,
   HistorySecretError,
 } from "./history-secret-git.mjs";
+import { classifyEvidence } from "./history-secret-evidence.mjs";
 
 export const VERSION = "8.30.1";
 /** Archive and extracted executable pins both come from the same official release. */
@@ -222,303 +223,12 @@ export const qualifyScanner = requested => {
   return binary;
 };
 
-const EVIDENCE_BUDGET = 64 * 1024 * 1024;
-const NO_REPLACEMENTS = "--no-replace-objects";
-const TAXONOMY = "Disk/missing/corrupt";
-const NARRATIVE = [
-  "AccessDenied boundaries,",
-  `${TAXONOMY} falsifications.`,
-].join(" ");
-const safePath = value =>
-  typeof value === "string" &&
-  value.length > 0 &&
-  !/[\\\u0000-\u001f\u007f]/u.test(value) &&
-  !/^(?:\/|[A-Za-z]:)/u.test(value) &&
-  value.split("/").every(part => part && part !== "." && part !== "..");
-
-/** Read authentic regular Git blobs, never trimmed text or worktree evidence. */
-const readBlob = (file, commit, cwd, budget) => {
-  if (!safePath(file)) return null;
-  const entries = gitRead(
-    ["--literal-pathspecs", "ls-tree", "-z", commit, "--", file],
-    cwd
-  )
-    .split("\0")
-    .filter(Boolean);
-  if (entries.length !== 1) return null;
-  const entry = entries[0].match(
-    /^(100644|100755) blob ([a-f0-9]{40}|[a-f0-9]{64})\t([\s\S]*)$/u
-  );
-  if (!entry || entry[3] !== file || entry[2].length !== commit.length)
-    return null;
-  const sizeText = gitRead(["cat-file", "-s", entry[2]], cwd);
-  const size = Number(sizeText);
-  if (!/^\d+$/u.test(sizeText) || !Number.isSafeInteger(size))
-    throw new HistorySecretError(
-      "Git blob size is invalid. Repair complete Git objects and retry; safety is unproved."
-    );
-  if (size > budget.remaining) return null;
-  const result = spawnSync(
-    "git",
-    [NO_REPLACEMENTS, "cat-file", "blob", entry[2]],
-    {
-      cwd,
-      env: gitEnvironment(),
-      timeout: 120000,
-      maxBuffer: EVIDENCE_BUDGET,
-    }
-  );
-  if (
-    result.error ||
-    result.signal ||
-    result.status !== 0 ||
-    result.stdout.length !== size ||
-    createHash(commit.length === 40 ? "sha1" : "sha256")
-      .update(`blob ${size}\0`)
-      .update(result.stdout)
-      .digest("hex") !== entry[2]
-  )
+/** Only structured safe attribution is serialized, never stderr or metadata strings. */
+export const scanCommits = (commits, cwd, requested, heads = []) => {
+  if (!Array.isArray(heads) || heads.some(head => !commits.includes(head)))
     throw new HistorySecretError(
-      "Git blob bytes cannot be verified. Repair complete Git objects and retry; no raw source is published."
+      "Evidence heads are not actual introduced commits. Supply original Git input and retry."
     );
-  budget.remaining -= size;
-  return result.stdout;
-};
-
-/** Native JSON validation plus bounded duplicate-aware lexical role attribution. */
-const evidenceMap = bytes => {
-  if (bytes.length > 1024 * 1024) return null;
-  const text = bytes.toString("utf8");
-  if (!Buffer.from(text).equals(bytes)) return null;
-  try {
-    const value = JSON.parse(text);
-    if (
-      !value ||
-      typeof value !== "object" ||
-      Array.isArray(value) ||
-      !value.source_sha256 ||
-      typeof value.source_sha256 !== "object" ||
-      Array.isArray(value.source_sha256)
-    )
-      return null;
-    const entries = Object.entries(value.source_sha256);
-    if (
-      !entries.length ||
-      entries.length > 256 ||
-      entries.some(
-        ([file, hash]) =>
-          !safePath(file) ||
-          typeof hash !== "string" ||
-          !/^[a-f0-9]{64}$/u.test(hash)
-      )
-    )
-      return null;
-    const tokens = [
-      ...text.matchAll(/"(?:\\[\s\S]|[^"\\])*"|[{}[\],:]|[^{}[\],:\s]+/gu),
-    ];
-    if (tokens.length > 8192) return null;
-    let cursor = 0;
-    const spans = [];
-    const visit = (path, depth) => {
-      if (depth > 32) throw new Error("Bounded JSON depth");
-      const token = tokens[cursor++];
-      if (token[0] === "{") {
-        const keys = new Set();
-        while (tokens[cursor][0] !== "}") {
-          const key = JSON.parse(tokens[cursor++][0]);
-          if (keys.has(key)) throw new Error("Duplicate decoded JSON key");
-          keys.add(key);
-          cursor++; // Native JSON validation already proved the colon.
-          visit([...path, key], depth + 1);
-          if (tokens[cursor][0] === ",") cursor++;
-        }
-        cursor++;
-      } else if (token[0] === "[") {
-        let index = 0;
-        while (tokens[cursor][0] !== "]") {
-          visit([...path, index++], depth + 1);
-          if (tokens[cursor][0] === ",") cursor++;
-        }
-        cursor++;
-      } else if (
-        path.length === 2 &&
-        path[0] === "source_sha256" &&
-        token[0][0] === '"'
-      ) {
-        const hash = JSON.parse(token[0]);
-        // Escaped values do not supply an unambiguous literal detector span.
-        if (token[0] !== JSON.stringify(hash))
-          throw new Error("Ambiguous digest spelling");
-        spans.push({
-          file: path[1],
-          hash,
-          start: Buffer.byteLength(text.slice(0, token.index + 1)),
-          end: Buffer.byteLength(
-            text.slice(0, token.index + token[0].length - 1)
-          ),
-        });
-      }
-    };
-    visit([], 0);
-    return cursor === tokens.length && spans.length === entries.length
-      ? { value, spans }
-      : null;
-  } catch {
-    // probe-direction: fail-closed — malformed, duplicate or over-budget JSON
-    // cannot establish evidence role; its detector findings remain blocking.
-    return null;
-  }
-};
-
-/** Clear only a uniquely attributed, independently established benign finding. */
-const classifyEvidence = cwd => {
-  const budget = { remaining: EVIDENCE_BUDGET };
-  const blobs = new Map();
-  const maps = new Map();
-  const blob = (file, commit) => {
-    const key = `${commit}\0${file}`;
-    if (!blobs.has(key)) {
-      if (blobs.size >= 256) return null;
-      blobs.set(key, readBlob(file, commit, cwd, budget));
-    }
-    return blobs.get(key);
-  };
-  return row => {
-    if (
-      row.RuleID !== "generic-api-key" ||
-      !safePath(row.File) ||
-      row.SymlinkFile !== "" ||
-      row.Secret !== "REDACTED" ||
-      typeof row.Match !== "string" ||
-      row.EndLine !== row.StartLine ||
-      !Number.isSafeInteger(row.StartColumn) ||
-      !Number.isSafeInteger(row.EndColumn) ||
-      row.StartColumn < 1 ||
-      row.EndColumn < row.StartColumn
-    )
-      return false;
-    const bytes = blob(row.File, row.Commit);
-    if (!bytes) return false;
-    let lineStart = 0;
-    for (let line = 1; line < row.StartLine; line++) {
-      const next = bytes.indexOf(10, lineStart);
-      if (next < 0) return false;
-      lineStart = next + 1;
-    }
-    const newline = bytes.indexOf(10, lineStart);
-    const lineEnd = newline < 0 ? bytes.length : newline;
-    const replacements = row.Match.split("REDACTED");
-    if (replacements.length !== 2) return false;
-    const line = bytes.subarray(lineStart, lineEnd);
-    const attributed = (candidate, left, right) => {
-      const template = replacements.join(candidate);
-      if (template.split(candidate).length !== 2) return false;
-      const original = Buffer.from(template);
-      const offset = line.indexOf(original);
-      if (offset < 0 || line.indexOf(original, offset + 1) >= 0) return false;
-      const start = lineStart + offset;
-      const end = start + original.length;
-      if (
-        left !== start + Buffer.byteLength(replacements[0]) ||
-        right !== left + Buffer.byteLength(candidate)
-      )
-        return false;
-      // Pinned 8.30.1 detect/location.go counts a preceding fragment newline
-      // in columns after its first line. Prove exactly one of those two byte
-      // frames against the actual unique Git span; never infer fragment state.
-      return (
-        [0, 1].filter(
-          newlineByte =>
-            start === lineStart + row.StartColumn - 1 - newlineByte &&
-            end === lineStart + row.EndColumn - newlineByte
-        ).length === 1
-      );
-    };
-    // A complete standalone validation paragraph excludes surrounding JSON,
-    // assignments and interpolated/code contexts, not merely their filenames.
-    if (
-      (bytes.equals(Buffer.from(NARRATIVE)) ||
-        bytes.equals(Buffer.from(`${NARRATIVE}\n`))) &&
-      attributed(
-        TAXONOMY,
-        NARRATIVE.indexOf(TAXONOMY),
-        NARRATIVE.indexOf(TAXONOMY) + TAXONOMY.length
-      )
-    )
-      return true;
-    const key = `${row.Commit}\0${row.File}`;
-    if (!maps.has(key)) {
-      const parsed = evidenceMap(bytes);
-      let valid = parsed !== null;
-      const revision =
-        parsed && Object.hasOwn(parsed.value, "source_revision")
-          ? parsed.value.source_revision
-          : row.Commit;
-      if (parsed && Object.hasOwn(parsed.value, "source_revision")) {
-        valid =
-          typeof revision === "string" &&
-          new RegExp(`^[a-f0-9]{${row.Commit.length}}$`, "u").test(revision);
-        if (valid) {
-          const type = spawnSync(
-            "git",
-            [NO_REPLACEMENTS, "cat-file", "-t", revision],
-            {
-              cwd,
-              env: gitEnvironment(),
-              timeout: 120000,
-              maxBuffer: 1024 * 1024,
-            }
-          );
-          const ancestry = spawnSync(
-            "git",
-            [
-              NO_REPLACEMENTS,
-              "merge-base",
-              "--is-ancestor",
-              revision,
-              row.Commit,
-            ],
-            {
-              cwd,
-              env: gitEnvironment(),
-              timeout: 120000,
-              maxBuffer: 1024 * 1024,
-            }
-          );
-          // probe-direction: fail-closed — an absent/unreachable revision or
-          // failed ancestry probe cannot establish a historical preimage.
-          valid =
-            !type.error &&
-            !type.signal &&
-            type.status === 0 &&
-            type.stdout.toString() === "commit\n" &&
-            !type.stderr.length &&
-            !ancestry.error &&
-            !ancestry.signal &&
-            ancestry.status === 0 &&
-            !ancestry.stdout.length &&
-            !ancestry.stderr.length;
-        }
-      }
-      if (valid)
-        for (const span of parsed.spans) {
-          const sourceBytes = blob(span.file, revision);
-          if (!sourceBytes || digest(sourceBytes) !== span.hash) {
-            valid = false;
-            break;
-          }
-        }
-      maps.set(key, valid ? parsed.spans : []);
-    }
-    const candidates = maps
-      .get(key)
-      .filter(span => attributed(span.hash, span.start, span.end));
-    return candidates.length === 1;
-  };
-};
-
-/** Only structured safe attribution is serialized, never stderr or metadata strings. */
-export const scanCommits = (commits, cwd, requested) => {
   const binary = qualifyScanner(requested);
   const scratch = mkdtempSync(join(tmpdir(), "lisa-history-scan-"));
   chmodSync(scratch, 0o700);
@@ -558,7 +268,7 @@ export const scanCommits = (commits, cwd, requested) => {
     });
     const findings = [];
     const audit = auditedGit(scratch);
-    const benign = classifyEvidence(cwd);
+    const benign = classifyEvidence(cwd, commits, [...new Set(heads)]);
     for (let offset = 0; offset < commits.length; offset += 100) {
       const group = commits.slice(offset, offset + 100);
       audit.begin();

package/all/copy-overwrite/scripts/lisa-history-secrets.mjs

@@ -25,6 +25,7 @@ export const main = async (
     const {
       HistorySecretError,
       objectWidth,
+      gitRead,
       parsePush,
       eventPairs,
       introducedCommits,
@@ -91,7 +92,13 @@ export const main = async (
       console.log("No introduced history. Scanner was not run.");
       return 0;
     }
-    const result = scanCommits(commits, cwd, scanner);
+    const heads = pairs
+      .filter(pair => !/^0+$/u.test(pair.after))
+      .map(pair =>
+        gitRead(["rev-parse", "--verify", `${pair.after}^{commit}`], cwd)
+      )
+      .filter(head => commits.includes(head));
+    const result = scanCommits(commits, cwd, scanner, heads);
     console.log(JSON.stringify(result));
     if (result.findings.length > 0) {
       console.error(

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -1077,17 +1077,36 @@ function trackerContract(config = readConfig()) {
   );
 }
 
+/**
+ * Resolve authored references before any binding or provider decision.
+ *
+ * The literal `github/` namespace is an identity spelling, not a different
+ * tracker or an exemption. Its ASCII segments must survive unchanged; URL
+ * parsing or path normalization would incorrectly admit encoded/dot paths.
+ * @param {unknown} raw Authored work-item reference.
+ * @param {object} contract Existing configured tracker contract.
+ * @returns {string} Repository-scoped canonical identity.
+ */
 function canonicalizeRef(raw, contract = trackerContract()) {
   const value = String(raw ?? "").trim();
   if (contract.provider === "github") {
+    const qualified =
+      /^github\/([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)#([1-9]\d*)$/.exec(value);
     // Match authored URL bytes before normalization: URL parsers can erase a
     // port or decode a path that this input contract deliberately refuses.
     const match =
+      qualified ??
       /^([^\s/#]+\/[^\s/#]+)#([1-9]\d*)$/.exec(value) ??
       /^https:\/\/github\.com\/([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)\/issues\/([1-9]\d*)$/.exec(
         value
       );
-    if (!match)
+    if (
+      !match ||
+      (qualified &&
+        qualified[1]
+          .split("/")
+          .some(segment => segment === "." || segment === ".."))
+    )
       throw new TrackingError(
         `Invalid GitHub Work-Item '${value}'; expected owner/repo#123`
       );
@@ -4542,6 +4561,10 @@ function backlink(args) {
  * repository does the commit declare? — and a value the filter drops is one the
  * reader still saw. That ordering is what keeps a malformed trailer refusable
  * by the gate instead of invisible to it.
+ * Qualified `github/owner/name#number` values use the SAME canonical resolver
+ * as the gates, so the audit does not lose attribution accepted by a hook.
+ * This audit still requires a hash-number declaration; supported issue URLs
+ * remain a gate input, not a newly admitted audit declaration.
  *
  * CRLF needs nothing here, and a relayed review finding that said otherwise
  * was refuted rather than acted on. `workItemLines` splits on `/\r?\n/`, so a
@@ -4553,16 +4576,19 @@ function backlink(args) {
  * @returns {number[]} Declared issue numbers, de-duplicated, in first-seen order.
  */
 export function declaredWorkItemNumbers(body, repository) {
-  const owner = String(repository ?? "").toLowerCase();
+  const owner = String(repository ?? "");
   if (owner === "") return [];
+  const contract = { provider: "github", repository: owner };
   const numbers = [];
   for (const value of workItemLines(body)) {
-    const hash = value.indexOf("#");
-    if (hash === -1) continue;
-    if (value.slice(0, hash).toLowerCase() !== owner) continue;
-    const digits = value.slice(hash + 1);
-    if (!isIssueNumber(digits)) continue;
-    numbers.push(Number(digits));
+    if (!value.includes("#")) continue;
+    try {
+      const ref = canonicalizeRef(value, contract);
+      const digits = ref.slice(ref.indexOf("#") + 1);
+      if (isIssueNumber(digits)) numbers.push(Number(digits));
+    } catch (error) {
+      if (!(error instanceof TrackingError)) throw error;
+    }
   }
   return [...new Set(numbers)];
 }

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAu7CjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA01CjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAo8CjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAu2CjC,CAAC"}

package/dist/core/lisa-owned-hash-ledger.js

@@ -447,6 +447,15 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "d234617dc907bb563455419957f2f419702fcd1c10b9d39e19d5bab8ca962008",
         "e07bab7dc4c4c296e2007cf26fab694b1238545dc37816e88d849606d8f9e760",
     ]),
+    "scripts/lib/history-secret-evidence-shape.mjs": Object.freeze([
+        "346393e1ba8a5fa9b35d14f86745e62de87b06b5626418e65ff6589d7a4828fc",
+        "f9b606645b9f3d55031e9cd0caf874395ae17ec6425f4a2adf6ca29e87560f0e",
+        "ff421c676daf8098f15d59f46a285076b0a9e4a94bdf5484f739cffc2fe5f8eb",
+    ]),
+    "scripts/lib/history-secret-evidence.mjs": Object.freeze([
+        "0475ac4654e33c2f24e0f10adbe79eb9db3229e1d2eb5160418b78545043410c",
+        "81247f4a85322a96e5ef049acec12b84925cc8fbac90b4a6811479f8a311e2b2",
+    ]),
     "scripts/lib/history-secret-git.mjs": Object.freeze([
         "102276aef106e07b2b385fe8f2d3b54a9d30381633a22e07d5d74a5db9ddf320",
         "254907d808a76d4f338d1cb86e9262c7e2992386a79cd417bc65b385f8253715",
@@ -460,6 +469,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "501452c19be923616a6ea1ed9443c86cbac14e4aa3073e579f6af82d1423a2c9",
         "6afcb5ea42d8f9046a17e2253d4ddbefdf9025b150870afda23db77796f05f25",
         "a68a4ba784699c470e1525ed3cd2f31f399cc80472d2bf5653d936bf3252c658",
+        "d77fc82db53ffbfef6bd714b600ed9f8b711cf52bbf630020efa4841ae5f083c",
         "fc2677b9f5ae86ee9709bb59f1e9cf231f258d12ddcfbf9a6dd9a711155220d2",
         "ff90535b7c6f24f48651ab93d204a1530c6bfaa8e6169d3aa83ab069c1a1ef22",
     ]),
@@ -794,6 +804,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "2d6ae84741703a300d78379eb4bdf3935815aba715cb163a34378418d17eadf0",
         "6887f865cee4cca397cac9f0efb366f2e5b9d4c68596f0306775709e354a85d2",
         "7b55063eb78d7796aeb1d9c1de8b66882ccbfcb524e33773757ffa307d987177",
+        "966301ef764ddd5cfb37d26c22dd2dc4712496e67f63adddde9635fec6f6136c",
     ]),
     "scripts/lisa-hooks/block-blind-automerge.sh": Object.freeze([
         "3f58a1bc31a36ae1720591013cd59fd3e9046c865aae2a795b29a2405aefb6a1",
@@ -1260,6 +1271,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "42176fa5ee6df11d2337a91b2eeeb31a9ed7cc1e16acb0cec11739ba5a6849ed",
         "4372872a448d3b943dea5541167ed5be6155703b57b9f8224d19ddefd3b80898",
         "475cb9ef86c2ac54c8fd8cb6d63e9a55ea8cd0017e26efbe3c44391a4aeeab41",
+        "47677cf8b388e62fc82efdf564f94a784499f23b7f290ee1d7f9f50cc8a8abc3",
         "4ae4e4e25c5fc075824a112a26abae6ab157c2888332c376db928b51530abc0a",
         "4c263fef48c03b3b6c623ea8a6cd55505bfaf28197e5072226ea35f9f3d26885",
         "4d054e3b7a266d69108f7cec12ee02e6a302670ff5932dc398cb0c5069b2a44f",
@@ -1287,6 +1299,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "6afe796f5a69a68a026c79a64aa451eb2bf7907a0ace0d9079f8b4add16b886b",
         "6ced6d3929f58e0b0b3e12717af537f9c4f57ad03c18d99e774026c169b13874",
         "6dadc065016e741568b6ae1ebcd0378085005c076fdb93346bad7c1fd9e3b8b8",
+        "6ec811517f212f6e6b33a8163f16a6b0538731c9cbe626e9f62a55b0f0af9518",
         "7156449f0ad8c68c40c3f7f02df91248e32d9d83a439b38c4ce0a3fd35e04c1e",
         "71fcbf510d3ac112417cea1bd0b4fd4b478e7f01a51f04b6a28fb7a487443d36",
         "71ff42c2cb8ac7022e0066132476764dd745fb92bf19ccd395000b1fe319abc7",
@@ -1904,6 +1917,15 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "d234617dc907bb563455419957f2f419702fcd1c10b9d39e19d5bab8ca962008",
         "e07bab7dc4c4c296e2007cf26fab694b1238545dc37816e88d849606d8f9e760",
     ]),
+    "scripts/lib/history-secret-evidence-shape.mjs": Object.freeze([
+        "346393e1ba8a5fa9b35d14f86745e62de87b06b5626418e65ff6589d7a4828fc",
+        "f9b606645b9f3d55031e9cd0caf874395ae17ec6425f4a2adf6ca29e87560f0e",
+        "ff421c676daf8098f15d59f46a285076b0a9e4a94bdf5484f739cffc2fe5f8eb",
+    ]),
+    "scripts/lib/history-secret-evidence.mjs": Object.freeze([
+        "0475ac4654e33c2f24e0f10adbe79eb9db3229e1d2eb5160418b78545043410c",
+        "81247f4a85322a96e5ef049acec12b84925cc8fbac90b4a6811479f8a311e2b2",
+    ]),
     "scripts/lib/history-secret-git.mjs": Object.freeze([
         "102276aef106e07b2b385fe8f2d3b54a9d30381633a22e07d5d74a5db9ddf320",
         "254907d808a76d4f338d1cb86e9262c7e2992386a79cd417bc65b385f8253715",
@@ -1917,6 +1939,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "501452c19be923616a6ea1ed9443c86cbac14e4aa3073e579f6af82d1423a2c9",
         "6afcb5ea42d8f9046a17e2253d4ddbefdf9025b150870afda23db77796f05f25",
         "a68a4ba784699c470e1525ed3cd2f31f399cc80472d2bf5653d936bf3252c658",
+        "d77fc82db53ffbfef6bd714b600ed9f8b711cf52bbf630020efa4841ae5f083c",
         "fc2677b9f5ae86ee9709bb59f1e9cf231f258d12ddcfbf9a6dd9a711155220d2",
         "ff90535b7c6f24f48651ab93d204a1530c6bfaa8e6169d3aa83ab069c1a1ef22",
     ]),
@@ -2206,6 +2229,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "2d6ae84741703a300d78379eb4bdf3935815aba715cb163a34378418d17eadf0",
         "6887f865cee4cca397cac9f0efb366f2e5b9d4c68596f0306775709e354a85d2",
         "7b55063eb78d7796aeb1d9c1de8b66882ccbfcb524e33773757ffa307d987177",
+        "966301ef764ddd5cfb37d26c22dd2dc4712496e67f63adddde9635fec6f6136c",
     ]),
     "scripts/lisa-hooks/block-blind-automerge.sh": Object.freeze([
         "3f58a1bc31a36ae1720591013cd59fd3e9046c865aae2a795b29a2405aefb6a1",
@@ -2649,6 +2673,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "42176fa5ee6df11d2337a91b2eeeb31a9ed7cc1e16acb0cec11739ba5a6849ed",
         "4372872a448d3b943dea5541167ed5be6155703b57b9f8224d19ddefd3b80898",
         "475cb9ef86c2ac54c8fd8cb6d63e9a55ea8cd0017e26efbe3c44391a4aeeab41",
+        "47677cf8b388e62fc82efdf564f94a784499f23b7f290ee1d7f9f50cc8a8abc3",
         "4ae4e4e25c5fc075824a112a26abae6ab157c2888332c376db928b51530abc0a",
         "4c263fef48c03b3b6c623ea8a6cd55505bfaf28197e5072226ea35f9f3d26885",
         "4d054e3b7a266d69108f7cec12ee02e6a302670ff5932dc398cb0c5069b2a44f",
@@ -2675,6 +2700,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "6afe796f5a69a68a026c79a64aa451eb2bf7907a0ace0d9079f8b4add16b886b",
         "6ced6d3929f58e0b0b3e12717af537f9c4f57ad03c18d99e774026c169b13874",
         "6dadc065016e741568b6ae1ebcd0378085005c076fdb93346bad7c1fd9e3b8b8",
+        "6ec811517f212f6e6b33a8163f16a6b0538731c9cbe626e9f62a55b0f0af9518",
         "7156449f0ad8c68c40c3f7f02df91248e32d9d83a439b38c4ce0a3fd35e04c1e",
         "71fcbf510d3ac112417cea1bd0b4fd4b478e7f01a51f04b6a28fb7a487443d36",
         "71ff42c2cb8ac7022e0066132476764dd745fb92bf19ccd395000b1fe319abc7",