@codyswann/lisa 4.70.4 → 4.71.1

package/all/copy-overwrite/scripts/lib/npm-update-hosted-hook.mjs

@@ -0,0 +1,157 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Original Node hook calls preserve argv/stdin while only authenticated helpers gain a read-only IPC route. */
+import { readJson, runProcess } from "./npm-update-process.mjs";
+import { required, keys } from "./npm-update-contract.mjs";
+import { currentGraph } from "./npm-update-orchestrator.mjs";
+import { realpathSync, lstatSync } from "node:fs";
+import { resolve, join, basename } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { binaryDigest } from "./npm-update-isolation.mjs";
+
+const ENTRY = fileURLToPath(import.meta.url);
+const PRELOAD = fileURLToPath(
+  new URL("./npm-update-hook-preload.mjs", import.meta.url)
+);
+const RAILS_INLINE =
+  'try { const { main } = await import("./scripts/lisa-rails-prepush.mjs"); process.exitCode = await main(process.argv.slice(1)); } catch { console.error("Managed Rails push tooling is unavailable or damaged. Run full Lisa apply and retry; raw bootstrap errors are withheld."); process.exitCode = 1; }';
+
+/** Context carries no token; the broker independently retains its immutable read subject in parent memory. */
+export function hostedHookContext(file) {
+  const context = readJson(file, 1_048_576);
+  keys(context, ["version", "root", "cwd", "graph", "native", "reader"]);
+  keys(context.reader, ["root", "path", "deadline"]);
+  keys(context.native, ["node", "git", "gh"]);
+  keys(context.native.node, ["path", "version", "sha256"]);
+  const root = lstatSync(context.root);
+  required(
+    context.version === 1 &&
+      file === join(context.root, "hosted-hooks.json") &&
+      realpathSync(context.root) === context.root &&
+      realpathSync(context.cwd) === context.cwd &&
+      root.isDirectory() &&
+      !root.isSymbolicLink() &&
+      root.uid === process.getuid() &&
+      (root.mode & 0o077) === 0 &&
+      context.reader.root === context.root &&
+      context.reader.path === join(context.root, "hook-reader.sock") &&
+      Number.isSafeInteger(context.reader.deadline) &&
+      context.reader.deadline > Date.now() &&
+      context.reader.deadline <= Date.now() + 1_800_000,
+    "invalid hosted hook context"
+  );
+  const observed = currentGraph(context.graph);
+  required(
+    Object.keys(observed).length <= 128 &&
+      Object.entries(context.graph).every(
+        ([path, hash]) => observed[path] === hash
+      ),
+    "authenticated hook graph changed"
+  );
+  required(
+    context.native.node.version === "22.23.3" &&
+      context.native.node.path === realpathSync(context.native.node.path) &&
+      binaryDigest(context.native.node.path) === context.native.node.sha256,
+    "hosted hook Node changed"
+  );
+  return { ...context, file, deadline: context.reader.deadline };
+}
+
+/** Inline qualification is one exact managed Rails bootstrap; arbitrary eval stays ordinary token-free application code. */
+export function hookEntry(context, args, cwd) {
+  if (
+    args[0] === "--input-type=module" &&
+    args[1] === "-e" &&
+    args[2] === RAILS_INLINE
+  ) {
+    const entry = join(cwd, "scripts/lisa-rails-prepush.mjs");
+    return Object.hasOwn(context.graph, entry) ? entry : null;
+  }
+  if (typeof args[0] !== "string" || args[0].startsWith("-")) return null;
+  const entry = resolve(cwd, args[0]);
+  return Object.hasOwn(context.graph, entry) ? entry : null;
+}
+
+/** Slots are limited read-state labels; they cannot grant a writer or widen the parent's subject. */
+export function hookReadSlot(entry, args, role) {
+  const name = basename(entry);
+  if (name === "lisa-work-item.mjs") {
+    if (args[1] === "prepare-commit-msg") return "commit-prepare";
+    if (args[1] === "validate-commit") return "commit-work-item";
+    if (args[1] === "validate-push" && ["audit", "destination"].includes(role))
+      return `${role}-work-item`;
+  }
+  if (name === "lisa-automation-provenance.mjs") {
+    if (args[1] === "check-commit") return "commit-provenance";
+    if (args[1] === "check-push" && ["audit", "destination"].includes(role))
+      return `${role}-provenance`;
+  }
+  return null;
+}
+
+/** Provider tokens, issuer secrets and ambient preload authority are absent from both helper and application processes. */
+export function tokenFreeHookEnvironment(source) {
+  const env = { ...source };
+  for (const name of Object.keys(env))
+    if (
+      /^(?:GH_TOKEN|GITHUB_TOKEN|ACTIONS_ID_TOKEN_|ACTIONS_RUNTIME_|LISA_NPM_DISPATCH_CONTEXT|NODE_OPTIONS|NODE_PATH)/.test(
+        name
+      )
+    )
+      delete env[name];
+  return env;
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  required(
+    args.length >= 3 && args[0] === "--context" && args[2] === "--",
+    "invalid hosted Node gateway"
+  );
+  const context = hostedHookContext(args[1]);
+  const original = args.slice(3);
+  const entry = hookEntry(context, original, realpathSync(process.cwd()));
+  if (entry)
+    required(
+      !original.some(arg =>
+        /^(?:-r|--require|--import|--(?:experimental-)?loader)(?:=|$)/.test(arg)
+      ) &&
+        !process.env.NODE_OPTIONS &&
+        !process.env.NODE_PATH,
+      "unqualified original canonical hook loader"
+    );
+  const env = tokenFreeHookEnvironment(process.env);
+  if (entry) env.LISA_NPM_HOSTED_HOOK_CONTEXT = context.file;
+  else delete env.LISA_NPM_HOSTED_HOOK_CONTEXT;
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    size += chunk.length;
+    required(size <= 4_194_304, "original hook stdin exceeded");
+    chunks.push(chunk);
+  }
+  const timeout = Math.min(1_800_000, context.deadline - Date.now());
+  required(timeout > 0, "original hook phase expired");
+  const result = await runProcess(
+    context.native.node.path,
+    entry ? ["--import", pathToFileURL(PRELOAD).href, ...original] : original,
+    {
+      cwd: process.cwd(),
+      env,
+      input: Buffer.concat(chunks),
+      timeout,
+      maximum: 8_388_608,
+      allowed: Array.from({ length: 256 }, (_, code) => code),
+    }
+  );
+  process.stdout.write(result.stdout);
+  process.stderr.write(result.stderr);
+  process.exitCode = result.code;
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === ENTRY)
+  main().catch(() => {
+    process.stderr.write("original hosted hook command failed\n");
+    process.exitCode = 1;
+  });

package/all/copy-overwrite/scripts/lib/npm-update-invariants.mjs

@@ -0,0 +1,28 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Pure shared diagnostics retain one error identity without importing producer orchestration. */
+
+/** Only trusted static boundary reasons may leave a phase as a public diagnostic. */
+export class UpdaterError extends Error {
+  constructor(reason) {
+    super(`npm updater: ${reason}`);
+  }
+}
+
+/** Reject a boundary explicitly without printing untrusted candidate values. */
+export function required(ok, reason) {
+  if (!ok) throw new UpdaterError(reason);
+}
+
+/** Unknown keys are never an executable extension point. */
+export function keys(value, expected) {
+  required(
+    value && typeof value === "object" && !Array.isArray(value),
+    "expected object"
+  );
+  required(
+    Object.keys(value).sort().join("\n") === [...expected].sort().join("\n"),
+    "unknown or missing fields"
+  );
+}

package/all/copy-overwrite/scripts/lib/npm-update-isolation.mjs

@@ -0,0 +1,11 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Public worker facade preserves the managed command import surface without initialization. @module npm-updater */
+export { workerArguments } from "./npm-update-worker-policy.mjs";
+export { assertWorkerInspection } from "./npm-update-worker-inspection.mjs";
+export {
+  executeWorker,
+  recoverWorkers,
+  binaryDigest,
+} from "./npm-update-worker-lifecycle.mjs";

package/all/copy-overwrite/scripts/lib/npm-update-leaf-contract.mjs

@@ -0,0 +1,171 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Pure environment, lifecycle and fixed Task data cannot import live claim or quality orchestration. */
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import { required } from "./npm-update-contract.mjs";
+import { trackerContract } from "../lisa-work-item.mjs";
+
+/** Immutable host config, not candidate data or local aliases, chooses lifecycle. */
+export function leafRoles(config, repository) {
+  required(
+    config.tracker === "github" &&
+      repository === `${config.github?.org}/${config.github?.repo}`,
+    "configured tracker scope differs"
+  );
+  required(
+    !config.github.queueRepo || config.github.queueRepo === repository,
+    "separate umbrella queues are not supported by this producer"
+  );
+  required(
+    !config.github.project &&
+      !config.github.projectV2 &&
+      !config.github.projects,
+    "configured ProjectV2 coordination requires the ordinary writer"
+  );
+  const build = config.github.labels?.build ?? {};
+  const contract = trackerContract(config);
+  const targetEnvironment = environment(config);
+  const terminal =
+    contract.lifecycle.done.find(([name]) => name === targetEnvironment)?.[1] ??
+    contract.lifecycle.terminalName;
+  required(
+    typeof terminal === "string" && terminal.trim().length > 0,
+    "configured main environment terminal label is missing"
+  );
+  const terminals = contract.lifecycle.done.map(([, role]) => role);
+  required(
+    terminals.every(
+      label => typeof label === "string" && label.trim().length > 0
+    ),
+    "configured terminal labels are invalid"
+  );
+  const later = contract.lifecycle.roles.filter(
+    label =>
+      label !== contract.lifecycle.ready &&
+      label !== (build.blocked ?? "status:blocked") &&
+      !terminals.includes(label)
+  );
+  return {
+    ready: contract.lifecycle.ready,
+    claimed: contract.lifecycle.claimed,
+    blocked: build.blocked ?? "status:blocked",
+    human: build.human_needed ?? "human-needed",
+    terminal,
+    terminals,
+    later,
+  };
+}
+
+/** Reuse the canonical default while refusing an explicitly ambiguous main mapping. */
+export function environment(config) {
+  const matches = Object.entries(config.deploy?.branches ?? {}).filter(
+    ([, branch]) => branch === "main"
+  );
+  required(
+    matches.length <= 1,
+    "main requires one unambiguous configured runtime environment"
+  );
+  const target = trackerContract(config).deployBranches.get("main");
+  required(target, "main has no configured runtime environment");
+  return target;
+}
+
+/** A standalone, build-ready Task has complete implementation and terminal evidence. */
+export function buildDraft(proposal, policy, config, evidence) {
+  const roles = leafRoles(config, policy.repository);
+  const env = environment(config);
+  const versions = proposal.updates
+    .map(update => `${update.name}: ${update.from} -> ${update.to}`)
+    .join("\n");
+  const body = `## Context / Business Value
+
+Keep the selected dependencies current while preserving ordinary review, required checks and runtime verification. This Task owns one exact dependency proposal; its implementation ticket is never reused for another update.
+
+## Technical Approach
+
+Base parent: ${proposal.parent}
+Proposal key: ${proposal.key}
+Selection key: ${proposal.selectionKey}
+Update exactly package.json and package-lock.json:
+${versions}
+Use the trusted four-job npm updater. Preparation performs an installed-tree npm outdated check and npm ci with lifecycle scripts disabled. Allocation precedes the first attributed commit. Ordinary commit and original pre-push gates remain mandatory. Publish only the exact gated unsigned raw Git object with unchanged parent, tree, identities, times and message. Preserve every unrelated dependency, script and existing assignee. Stop on stale base, unavailable authorization, hold, failed gate or mismatching bytes. Lisa is excluded only with verified local full-apply ownership.
+
+## Acceptance Criteria
+
+\`\`\`gherkin
+Scenario: publish one coherent dependency proposal
+  Given parent ${proposal.parent} and the selected versions above
+  When the trusted updater claims this leaf and completes ordinary gates
+  Then the manifest and lock agree and npm ci preserves both file hashes
+  And the pull request into main contains exactly the gated commit and two files
+Scenario: refuse unauthorized or stale publication
+  Given a hold, changed parent, failed gate or mismatching proposal
+  When publication is attempted
+  Then no branch or pull request is written and a diagnostic reports failure
+Scenario: complete ordinary review and runtime verification
+  Given the pull request at its current head
+  When a trusted human approves and every configured required check succeeds
+  Then runtime verification in ${env} provides the declared evidence before closure
+\`\`\`
+
+## Out of Scope
+
+No repository scripts, lifecycle execution, package-manager migration, workspaces, merge, deployment, review approval, protection changes or automatic issue closure. No generic Lisa version-only update.
+
+## Repository
+
+${policy.repository}
+
+## Target Backend Environment
+
+Assumption: ${env} — remote default branch main
+
+## Branch Plan
+
+Branch from: main
+PR into: main
+Derived from: Target Backend Environment ${env} via .lisa.config.json deploy.branches
+
+## Sign-in Required
+
+GitHub Actions runtime token with explicitly reduced job permissions. Trusted maintainer: ${policy.maintainer}. No maintainer credential is used. Allocation alone may sign. Preparation and gates have no provider write or issuance authority.
+
+## Source Precedence
+
+Business rules: this exact proposal and ordinary configured policy. Visual: existing application. Flow: existing application. API/data: committed npm manifest, coherent registry lock and installed-tree checks. Stop and report cross-axis conflicts.
+
+## Relationship Search
+
+Historical filing evidence, preserved from initial allocation. Current relationships and eligibility are checked again before each recovery.
+Git history command: ${evidence.history.command}
+Git history outcome: ${evidence.history.result}
+All-state GitHub query: ${evidence.search.query}
+Outcome: every matching record was loaded completely; unrelated work was preserved and exact proposal recovery was checked separately.
+Matches are read completely before allocating this deterministic proposal. No parent or PRD lineage is declared; this build-ready standalone Task is one leaf.
+
+## Validation Journey
+
+1. Prepare the selected update from the exact parent with installed npm outdated; record actual exit and versions. [EVIDENCE: cli-output: npm-outdated]
+2. Run script-disabled npm ci against the proposed files and record unchanged hashes. [EVIDENCE: cli-output: npm-ci]
+3. Record normal commit/pre-push hook exits, all-ref stdin/ranges and the exact raw commit identity. [EVIDENCE: test-run-log: ordinary-gates]
+4. Read the current-head pull request, required checks and genuine human approval. [EVIDENCE: state-dump: current-head-review]
+5. Verify ordinary application behavior in ${env}; record actual environment and deployed identity. [EVIDENCE: test-run-log: runtime-verification]
+6. Reach a stale-base or hold rejection before any publication write. [EVIDENCE: cli-output: rejected-publication]
+
+## Proposal Bytes
+
+package.json SHA256: ${proposal.hashes["package.json"]}
+package-lock.json SHA256: ${proposal.hashes["package-lock.json"]}
+
+<!-- [lisa-npm-filing] ${Buffer.from(canonicalJson(evidence)).toString("base64")} -->
+<!-- [lisa-npm-proposal] ${proposal.key} -->
+`;
+  return {
+    title: "Update selected npm dependencies",
+    body,
+    labels: ["type:Task", "priority:medium", roles.ready],
+    assignees: [policy.maintainer],
+    build_ready: true,
+  };
+}

package/all/copy-overwrite/scripts/lib/npm-update-leaf.mjs

@@ -0,0 +1,194 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/**
+ * @file npm-update-leaf.mjs
+ * @description A fixed dependency Task still owes all writer gates and current human authorization.
+ * @module npm-updater
+ */
+import { canonicalClassifier } from "./npm-update-helper.mjs";
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import { required, CLAIM, keys } from "./npm-update-contract.mjs";
+import { qualityGates } from "./npm-update-quality.mjs";
+import { leafRoles } from "./npm-update-leaf-contract.mjs";
+export {
+  leafRoles,
+  environment,
+  buildDraft,
+} from "./npm-update-leaf-contract.mjs";
+import { sha256 } from "./github-attestation-verifier.mjs";
+
+/** Each transition rereads holds, ownership and the actual managed claim. */
+export async function claimLeaf(
+  api,
+  suppliedIssue,
+  draft,
+  proposal,
+  policy,
+  config,
+  evidence,
+  roles
+) {
+  let issue = await api.issue(suppliedIssue.number);
+  let state = await inspectLeaf(issue, draft, policy, config);
+  qualityGates(
+    { ...draft, title: issue.title, body: issue.body },
+    proposal,
+    policy,
+    config,
+    evidence
+  );
+  if (state.unassigned) {
+    await api.assignable(policy.maintainer);
+    await api.request(
+      `repos/${policy.repository}/issues/${issue.number}/assignees`,
+      "POST",
+      { assignees: [policy.maintainer] }
+    );
+  }
+  issue = await api.issue(issue.number);
+  state = await inspectLeaf(issue, draft, policy, config);
+  required(!state.unassigned, "allocation lacks trusted maintainer ownership");
+  if (!state.claimed) {
+    const labels = issue.labels
+      .map(label => label.name)
+      .filter(name => name !== roles.ready);
+    labels.push(roles.claimed);
+    await api.request(
+      `repos/${policy.repository}/issues/${issue.number}`,
+      "PATCH",
+      { labels }
+    );
+  }
+  issue = await api.issue(issue.number);
+  state = await inspectLeaf(issue, draft, policy, config);
+  if (!state.claims.length)
+    await api.request(
+      `repos/${policy.repository}/issues/${issue.number}/comments`,
+      "POST",
+      { body: CLAIM }
+    );
+  issue = await api.issue(issue.number);
+  state = await inspectLeaf(issue, draft, policy, config);
+  required(
+    state.claimed &&
+      state.claims.length === 1 &&
+      String(state.claims[0].user?.id) === api.policy.claimActorId &&
+      state.claims[0].user?.type === "Bot",
+    "actual managed claim identity differs"
+  );
+  return { issue, state };
+}
+
+/** Complete provider history and immutable human policy govern every mutation. */
+export async function inspectLeaf(issue, draft, policy, config) {
+  const roles = leafRoles(config, policy.repository);
+  const labels = issue.labels.map(label => label.name);
+  required(
+    issue.state === "open" && !issue.pull_request && issue.number > 0,
+    "closed or nonissue leaf"
+  );
+  required(
+    issue.children.length === 0 &&
+      issue.blockers.every(item => item.state === "closed"),
+    "child work or active blocker"
+  );
+  required(
+    !/- \[[ x]\]/i.test(issue.body) && !labels.includes("type:Epic"),
+    "container is not claimable"
+  );
+  required(
+    !roles.terminals.some(label => labels.includes(label)) &&
+      !labels.includes(roles.blocked),
+    "terminal or blocked leaf"
+  );
+  const hold = (await canonicalClassifier(config))({
+    body: issue.body,
+    labels,
+    comments: issue.comments,
+    trustedHumanActorIds: config.github.trustedHumanActorIds ?? [],
+    humanNeededLabel: roles.human,
+  });
+  required(!hold.held, "current human hold is outstanding");
+  required(
+    issue.body === draft.body && issue.title === draft.title,
+    "live proposal specification differs"
+  );
+  required(
+    issue.assignees.every(
+      actor => actor.login === policy.maintainer && actor.type === "User"
+    ),
+    "existing assignee is foreign; preserve ownership"
+  );
+  required(
+    ["type:Task", "priority:medium"].every(label => labels.includes(label)),
+    "required live labels differ"
+  );
+  const claims = issue.comments.filter(comment => comment.body === CLAIM);
+  required(claims.length <= 1, "ambiguous managed claims");
+  return {
+    claimed: labels.some(label => roles.later.includes(label)),
+    unassigned: issue.assignees.length === 0,
+    claims,
+    roles,
+  };
+}
+
+/** Initial public filing evidence is immutable specification, not live authorization. */
+export function historicalFiling(issue) {
+  const matches = [
+    ...issue.body.matchAll(/<!-- \[lisa-npm-filing\] ([A-Za-z0-9+/]+=*) -->/g),
+  ];
+  required(
+    matches.length === 1 && matches[0][1].length <= 65_536,
+    "original filing evidence is missing or ambiguous"
+  );
+  const bytes = Buffer.from(matches[0][1], "base64");
+  required(
+    bytes.toString("base64") === matches[0][1],
+    "original filing encoding differs"
+  );
+  const value = JSON.parse(
+    new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes)
+  );
+  keys(value, ["history", "search", "registry", "labels", "main"]);
+  required(
+    canonicalJson(value) === bytes.toString("utf8"),
+    "original filing fields are noncanonical"
+  );
+  return value;
+}
+
+export { qualityGates } from "./npm-update-quality.mjs";
+
+/** Every privileged transition rechecks current policy, claim, owner and holds. */
+export async function authorizeAllocation(
+  api,
+  proposal,
+  allocation,
+  policy,
+  config
+) {
+  await api.main(proposal.parent);
+  await api.assignable(policy.maintainer);
+  const issue = await api.issue(allocation.number);
+  const state = await inspectLeaf(issue, allocation.draft, policy, config);
+  required(
+    state.claimed &&
+      !state.unassigned &&
+      state.claims.length === 1 &&
+      String(state.claims[0].id) === allocation.claimCommentId &&
+      String(state.claims[0].user?.id) === api.policy.claimActorId &&
+      state.claims[0].user?.type === "Bot" &&
+      sha256(state.claims[0].body) === allocation.claimSha256,
+    "current proposal claim differs"
+  );
+  qualityGates(
+    { ...allocation.draft, title: issue.title, body: issue.body },
+    proposal,
+    policy,
+    config,
+    allocation.evidence
+  );
+  return issue;
+}