@codyswann/lisa 4.70.3 → 4.71.0

package/all/copy-overwrite/scripts/lib/npm-update-gate-hooks.mjs

@@ -0,0 +1,214 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Original hook transport distinguishes artifact audit from actual remote state. */
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import { required, OBJECT, keys } from "./npm-update-contract.mjs";
+import { sha256 } from "./github-attestation-verifier.mjs";
+export { managedTemplateMembers } from "./npm-update-helper-graph.mjs";
+export {
+  originalPrePush,
+  originalHookInstallation,
+} from "./npm-update-hook-installation.mjs";
+
+/** Private parent-created tuples remain data; their configuration and helper authority is qualified separately. */
+function configuredTuple(route, graph) {
+  keys(route, ["tool", "args", "cwd", "entry", "configuration", "environment"]);
+  required(
+    ["node", "shell", "bash"].includes(route.tool) &&
+      typeof route.cwd === "string" &&
+      route.cwd.startsWith("/") &&
+      !route.cwd.split("/").includes(".."),
+    "invalid configured controller tuple"
+  );
+  required(
+    Array.isArray(route.args) &&
+      route.args.length <= 512 &&
+      route.args.every(
+        value =>
+          typeof value === "string" &&
+          !value.includes("\0") &&
+          Buffer.byteLength(value) <= 65_536
+      ) &&
+      Buffer.byteLength(canonicalJson(route.args)) <= 262_144,
+    "unbounded configured command tuple"
+  );
+  required(
+    route.entry === null ||
+      (typeof route.entry === "string" && Object.hasOwn(graph, route.entry)),
+    "configured helper entry is unqualified"
+  );
+  if (route.tool === "node")
+    required(
+      route.entry !== null &&
+        route.args[0] === "--input-type=module" &&
+        route.args[1] === "-e" &&
+        typeof route.args[2] === "string",
+      "unknown configured inline Node route"
+    );
+  else
+    required(
+      route.args.length === 2 && route.args[0] === "-c",
+      "unknown configured native shell route"
+    );
+  required(
+    route.configuration &&
+      typeof route.configuration === "object" &&
+      !Array.isArray(route.configuration) &&
+      Object.keys(route.configuration).length > 0 &&
+      Object.keys(route.configuration).length <= 16,
+    "configured command authority is missing or unbounded"
+  );
+  required(
+    route.environment &&
+      typeof route.environment === "object" &&
+      !Array.isArray(route.environment) &&
+      Object.keys(route.environment).length <= 64 &&
+      typeof route.environment.PATH === "string",
+    "configured environment is unresolved"
+  );
+  required(
+    Object.entries(route.environment).every(
+      ([name, value]) =>
+        /^[A-Z][A-Z0-9_]*$/.test(name) &&
+        typeof value === "string" &&
+        !value.includes("\0") &&
+        Buffer.byteLength(value) <= 4096
+    ),
+    "invalid configured environment tuple"
+  );
+}
+
+/** Helper imports and every included configuration byte form one bounded current closure. */
+export function controllerGraph(graph, routes = []) {
+  required(
+    Array.isArray(routes) && routes.length <= 64,
+    "configured command inventory exceeds bound"
+  );
+  const expected = { ...graph };
+  for (const route of routes) {
+    configuredTuple(route, graph);
+    for (const [path, hash] of Object.entries(route.configuration)) {
+      required(
+        path.startsWith("/") &&
+          /^[a-f0-9]{64}$/.test(hash) &&
+          (!Object.hasOwn(expected, path) || expected[path] === hash),
+        "configured configuration graph differs"
+      );
+      expected[path] = hash;
+    }
+  }
+  required(
+    Object.keys(expected).length <= 128,
+    "configured helper/configuration closure exceeds bound"
+  );
+  return expected;
+}
+
+/** Exact tuples cannot grant general eval or native shell authority to an unmatched invocation. */
+export function configuredRoute(tool, args, routes, cwd, environment) {
+  const matches = routes.filter(
+    route =>
+      route.tool === tool &&
+      route.cwd === cwd &&
+      canonicalJson(route.args) === canonicalJson(args)
+  );
+  required(matches.length <= 1, "ambiguous configured controller command");
+  if (!matches.length) return false;
+  required(
+    ![
+      "NODE_OPTIONS",
+      "NODE_PATH",
+      "ENV",
+      "BASH_ENV",
+      "LD_PRELOAD",
+      "LD_LIBRARY_PATH",
+      "RUBYOPT",
+      "GIT_EXEC_PATH",
+    ].some(name => environment[name]),
+    "unqualified configured environment loader"
+  );
+  required(
+    Object.entries(matches[0].environment).every(
+      ([name, value]) => environment[name] === value
+    ),
+    "configured controller environment changed"
+  );
+  return true;
+}
+
+/** A publication has one full audit and one accurately observed destination stream. */
+export function gateStreams(branch, commit, parent, destination) {
+  required(
+    /^lisa\/npm-[a-f0-9]{64}$/.test(branch) &&
+      OBJECT.test(commit) &&
+      OBJECT.test(parent),
+    "invalid gated ref identity"
+  );
+  required(
+    destination === null || destination === commit,
+    "foreign publication destination"
+  );
+  const line = oid =>
+    `refs/heads/${branch} ${commit} refs/heads/${branch} ${oid}\n`;
+  return {
+    audit: { kind: "full-proposal-audit", refs: line(parent), range: [commit] },
+    destination: {
+      kind:
+        destination === null
+          ? "absent-destination"
+          : "existing-destination-no-op",
+      refs: line(destination ?? "0".repeat(40)),
+      range: destination === null ? [commit] : [],
+    },
+  };
+}
+
+/** Empty transport never supplies a full proposal audit or excuses a failed original gate. */
+export function assertGateTransport(
+  receipt,
+  branch,
+  commit,
+  parent,
+  destination
+) {
+  const streams = gateStreams(branch, commit, parent, destination);
+  for (const role of ["audit", "destination"]) {
+    const actual = receipt[role];
+    required(
+      actual?.exit === 0 &&
+        actual.kind === streams[role].kind &&
+        actual.refs === streams[role].refs &&
+        canonicalJson(actual.range) === canonicalJson(streams[role].range),
+      "original full audit or destination gate differs"
+    );
+  }
+}
+
+/** A no-op destination cannot substitute for an independently successful complete-range audit. */
+export async function runGateStreams(
+  branch,
+  commit,
+  parent,
+  destination,
+  execute
+) {
+  const streams = gateStreams(branch, commit, parent, destination);
+  const receipt = {};
+  for (const role of ["audit", "destination"]) {
+    const result = await execute(streams[role].refs);
+    required(
+      result?.code === 0 &&
+        Buffer.isBuffer(result.stdout) &&
+        Buffer.isBuffer(result.stderr),
+      `ordinary ${role} gate failed or native result is invalid`
+    );
+    receipt[role] = {
+      ...streams[role],
+      exit: result.code,
+      logSha256: sha256(Buffer.concat([result.stdout, result.stderr])),
+    };
+  }
+  assertGateTransport(receipt, branch, commit, parent, destination);
+  return receipt;
+}

package/all/copy-overwrite/scripts/lib/npm-update-gate-install.mjs

@@ -0,0 +1,267 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Exact proposed installation is sealed only after its isolated namespace is absent. @module npm-updater */
+import { required, keys } from "./npm-update-contract.mjs";
+import {
+  chmodSync,
+  lstatSync,
+  readdirSync,
+  realpathSync,
+  existsSync,
+} from "node:fs";
+import { join, sep } from "node:path";
+import { executeWorker } from "./npm-update-isolation.mjs";
+import { namespaceRecords } from "./npm-update-orchestrator.mjs";
+import { toolIdentity, validateRuntime } from "./npm-update-runtime.mjs";
+import { sha256 } from "./github-attestation-verifier.mjs";
+import { readBytes } from "./npm-update-process.mjs";
+import { fileURLToPath } from "node:url";
+const HEX = /^[a-f0-9]{64}$/;
+export { validateRuntime } from "./npm-update-runtime.mjs";
+
+/** Ordinary npm installs the exact proposal with no lifecycle code or deployment authority. */
+export async function installDependencies(boundary, tools, engineStrict) {
+  required(
+    boundary.role === "install" && typeof engineStrict === "boolean",
+    "installation requires its isolated role and resolved engine policy"
+  );
+  toolIdentity(tools);
+  required(
+    namespaceRecords(boundary.root).length === 0,
+    "installation requires completed owned namespace recovery"
+  );
+  const args = [
+    tools.npm.path,
+    "ci",
+    "--ignore-scripts",
+    "--no-audit",
+    "--no-fund",
+  ];
+  if (engineStrict) args.push("--engine-strict");
+  const result = await executeWorker(boundary, {
+    command: tools.node.path,
+    args,
+  });
+  required(result.code === 0, "actual proposed npm installation failed");
+  required(
+    namespaceRecords(boundary.root).length === 0,
+    "installer namespace cleanup remains outstanding"
+  );
+  const sealed = sealDependencies(join(boundary.root, "dependencies"), true);
+  return { code: result.code, files: sealed.files, bytes: sealed.bytes };
+}
+
+/** Frozen Bundler supports only the committed public-source and exact runtime contract. */
+export function rubyInstallationInputs(inputs, tools) {
+  keys(inputs, ["lock", "rubyVersion", "configurationPresent"]);
+  required(
+    typeof inputs.lock === "string" &&
+      Buffer.byteLength(inputs.lock) <= 3_145_728 &&
+      !inputs.lock.includes("\0") &&
+      typeof inputs.rubyVersion === "string" &&
+      inputs.rubyVersion.trim() === "3.4.11",
+    "unsupported Ruby installation inputs"
+  );
+  required(
+    inputs.configurationPresent === false,
+    "configured alternate Bundler policy is unsupported"
+  );
+  required(
+    tools.ruby?.path === "/usr/local/bin/ruby" &&
+      /^ruby 3\.4\.11(?:p\d+)?\s/.test(tools.ruby.version) &&
+      tools.bundle?.path === "/usr/local/bin/bundle" &&
+      tools.bundle.version === "Bundler version 2.4.10",
+    "unsupported genuine Ruby/Bundler identity"
+  );
+  const lock = inputs.lock.replaceAll("\r\n", "\n");
+  const headers = [...lock.matchAll(/^([A-Z][A-Z ]+)$/gm)].map(
+    match => match[1]
+  );
+  required(
+    lock.startsWith("GEM\n") &&
+      headers.every(header =>
+        [
+          "GEM",
+          "PLATFORMS",
+          "DEPENDENCIES",
+          "RUBY VERSION",
+          "BUNDLED WITH",
+          "CHECKSUMS",
+        ].includes(header)
+      ),
+    "private/git/path Ruby sources are unsupported"
+  );
+  const remotes = [...lock.matchAll(/^ {2}remote: (.+)$/gm)].map(
+    match => match[1]
+  );
+  required(
+    remotes.length === 1 && /^https:\/\/rubygems\.org\/?$/.test(remotes[0]),
+    "private or alternate Ruby source is unsupported"
+  );
+  required(
+    /\nRUBY VERSION\n {3}ruby 3\.4\.11p\d*(?:\n|$)/.test(lock) &&
+      /\nBUNDLED WITH\n {3}2\.4\.10(?:\n|$)/.test(lock),
+    "frozen Ruby/Bundler lock identity differs"
+  );
+}
+
+/** Read-only source bytes are checked before and after the entire isolated installer. */
+function rubySource(boundary, tools) {
+  const mount = boundary.mounts.find(
+    value => value.target === boundary.workspace && value.readOnly === true
+  );
+  required(
+    mount && realpathSync(mount.source) === mount.source,
+    "Ruby installer source projection is missing or aliased"
+  );
+  const source = mount.source;
+  const lock = readBytes(join(source, "Gemfile.lock"), 3_145_728, false);
+  const manifest = readBytes(join(source, "Gemfile"), 1_048_576, false);
+  const decoder = new TextDecoder("utf8", { fatal: true });
+  rubyInstallationInputs(
+    {
+      lock: decoder.decode(lock),
+      rubyVersion: decoder.decode(
+        readBytes(join(source, ".ruby-version"), 128, false)
+      ),
+      configurationPresent: existsSync(join(source, ".bundle")),
+    },
+    tools
+  );
+  return { source, lock, manifest };
+}
+
+/** Native extensions load only in the separate dependency-only installer namespace. */
+export async function installRubyDependencies(boundary, tools) {
+  required(
+    boundary.role === "ruby-install",
+    "Ruby installation requires its separate isolated role"
+  );
+  toolIdentity(tools);
+  required(
+    namespaceRecords(boundary.root).length === 0,
+    "Ruby installation requires completed namespace recovery"
+  );
+  const input = rubySource(boundary, tools);
+  const result = await executeWorker(boundary, {
+    command: tools.bundle.path,
+    args: ["_2.4.10_", "install", "--jobs", "2", "--retry", "0"],
+  });
+  required(result.code === 0, "actual frozen Ruby installation failed");
+  required(
+    namespaceRecords(boundary.root).length === 0,
+    "Ruby installer namespace cleanup remains outstanding"
+  );
+  required(
+    readBytes(join(input.source, "Gemfile"), 1_048_576, false).equals(
+      input.manifest
+    ) &&
+      readBytes(join(input.source, "Gemfile.lock"), 3_145_728, false).equals(
+        input.lock
+      ),
+    "Ruby installer changed committed baseline bytes"
+  );
+  const sealed = sealDependencies(
+    join(boundary.root, "ruby-dependencies"),
+    true
+  );
+  return { code: result.code, files: sealed.files, bytes: sealed.bytes };
+}
+
+/** Only installer-owned dependency files may be sealed after its entire namespace is absent. */
+export function sealDependencies(directory, installerAbsent) {
+  required(
+    installerAbsent === true && realpathSync(directory) === directory,
+    "dependency sealing requires reaped installer and unaliased root"
+  );
+  const root = lstatSync(directory);
+  required(
+    root.isDirectory() &&
+      !root.isSymbolicLink() &&
+      root.uid === process.getuid(),
+    "installed dependency root is not controller owned"
+  );
+  const pending = [directory];
+  let count = 0;
+  let bytes = 0;
+  const files = [];
+  while (pending.length) {
+    const parent = pending.pop();
+    for (const entry of readdirSync(parent, { withFileTypes: true })) {
+      const path = join(parent, entry.name);
+      const stat = lstatSync(path);
+      required(
+        ++count <= 300_000 && stat.uid === process.getuid(),
+        "installed dependency ownership/inventory differs"
+      );
+      if (stat.isSymbolicLink()) {
+        required(
+          realpathSync(path).startsWith(`${directory}${sep}`),
+          "installed dependency alias escapes its sealed tree"
+        );
+        continue;
+      }
+      required(
+        stat.isFile() || stat.isDirectory(),
+        "installed dependency contains a special file"
+      );
+      if (stat.isDirectory()) pending.push(path);
+      else {
+        bytes += stat.size;
+        required(
+          bytes <= 10_737_418_240 && stat.nlink === 1,
+          "installed dependency size or link ownership differs"
+        );
+      }
+      files.push({
+        path,
+        mode: stat.isDirectory() || stat.mode & 0o111 ? 0o555 : 0o444,
+      });
+    }
+  }
+  for (const file of files) chmodSync(file.path, file.mode);
+  chmodSync(directory, 0o555);
+  required(
+    files.every(file => (lstatSync(file.path).mode & 0o222) === 0) &&
+      (lstatSync(directory).mode & 0o222) === 0,
+    "installed dependency sealing readback differs"
+  );
+  return { files: count, bytes };
+}
+
+/** The committed caller pins the actual managed catalog bytes independently of the parsed policy. */
+export function loadRuntime(config, platform) {
+  const file = fileURLToPath(
+    new URL("../npm-updater-gate-runtime.json", import.meta.url)
+  );
+  const digest = config.automationProvenance?.gateRuntimeSha256;
+  required(
+    typeof digest === "string" && HEX.test(digest),
+    "committed qualified gate runtime digest is missing"
+  );
+  const bytes = readBytes(file, 1_048_576, false);
+  required(
+    sha256(bytes) === digest,
+    "qualified gate runtime catalog bytes differ"
+  );
+  const value = JSON.parse(
+    new TextDecoder("utf8", { fatal: true }).decode(bytes)
+  );
+  const selected = validateRuntime(value, platform);
+  const recipe = fileURLToPath(
+    new URL("../npm-updater-gate.Dockerfile", import.meta.url)
+  );
+  required(
+    sha256(readBytes(recipe, 65_536, false)) === value.recipeSha256,
+    "qualified runtime recipe bytes differ"
+  );
+  const supervisor = fileURLToPath(
+    new URL("../npm-updater-gate-supervisor.c", import.meta.url)
+  );
+  required(
+    sha256(readBytes(supervisor, 65_536, false)) === value.supervisorSha256,
+    "qualified supervisor source bytes differ"
+  );
+  return { value, selected };
+}

package/all/copy-overwrite/scripts/lib/npm-update-gate-proof.mjs

@@ -0,0 +1,99 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Complete private proof transport; the ordinary verifier still authenticates every byte. */
+import { lstatSync, mkdirSync, realpathSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { required } from "./npm-update-contract.mjs";
+import { readBytes, writeJson } from "./npm-update-process.mjs";
+
+/** Optional recovery is always a pair, never silently downgraded to origin authority. */
+export function validateGateProof(proof) {
+  required(
+    (proof.recovery !== undefined) === (proof.recoveryBundle !== undefined),
+    "partial gate recovery proof"
+  );
+  for (const [name, maximum] of [
+    ["bundle", 1_048_576],
+    ["recovery", 65_536],
+    ["recoveryBundle", 1_048_576],
+  ]) {
+    const bytes = proof[name];
+    required(
+      (name !== "bundle" && bytes === undefined) ||
+        (Buffer.isBuffer(bytes) && bytes.length > 0 && bytes.length <= maximum),
+      "invalid bounded gate proof bytes"
+    );
+  }
+}
+
+/** Dangling aliases are present invalid inputs, never an absent recovery slot. */
+function present(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+/** Read all fixed slots before any attributed checkout operation. */
+export function readGateProof(directory) {
+  const recovery = join(directory, "recovery.json");
+  const recoveryBundle = join(directory, "recovery-bundle.json");
+  required(
+    present(recovery) === present(recoveryBundle),
+    "partial gate recovery proof"
+  );
+  const proof = {
+    bundle: readBytes(join(directory, "bundle.json"), 1_048_576),
+    recovery: present(recovery) ? readBytes(recovery, 65_536) : undefined,
+    recoveryBundle: present(recoveryBundle)
+      ? readBytes(recoveryBundle, 1_048_576)
+      : undefined,
+  };
+  validateGateProof(proof);
+  return proof;
+}
+
+/** Exclusive writes preserve original and recovery proof bytes; no transport grants verification. */
+export function writeGateProof(directory, descriptor, proof) {
+  validateGateProof(proof);
+  mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const stat = lstatSync(directory);
+  required(
+    stat.isDirectory() &&
+      !stat.isSymbolicLink() &&
+      realpathSync(directory) === resolve(directory) &&
+      stat.uid === process.getuid() &&
+      (stat.mode & 0o077) === 0,
+    "gate proof directory is aliased or public"
+  );
+  writeJson(join(directory, "descriptor.json"), descriptor);
+  for (const [key, file] of [
+    ["bundle", "bundle.json"],
+    ["recovery", "recovery.json"],
+    ["recoveryBundle", "recovery-bundle.json"],
+  ])
+    if (proof[key] !== undefined)
+      writeFileSync(join(directory, file), proof[key], {
+        mode: 0o600,
+        flag: "wx",
+      });
+}
+
+/** Resolve the real Git control path and preserve the complete private proof and message. */
+export async function installGateProof(context, root, git) {
+  const control = (await git(["rev-parse", "--git-common-dir"])).stdout
+    .toString()
+    .trim();
+  writeGateProof(
+    resolve(context.cwd, control, "lisa/automation-provenance"),
+    context.preview.descriptor,
+    context
+  );
+  const message = join(root, "message");
+  writeFileSync(message, context.preview.message, { mode: 0o600, flag: "wx" });
+  return message;
+}