@codyswann/lisa 4.71.0 → 4.71.2

package/all/copy-overwrite/scripts/lib/history-secret-scanner.mjs

@@ -52,6 +52,18 @@ export const PINS = Object.freeze({
 const digest = bytes => createHash("sha256").update(bytes).digest("hex");
 const shellQuote = value => `'${value.replaceAll("'", "'\\''")}'`;
 
+/** Keep vendor recreation private without changing the calling process's mask. */
+export const scannerInvocation = (binary, argv) => ({
+  binary: "/bin/sh",
+  argv: [
+    "-c",
+    'umask 077 || exit 1; exec "$@"',
+    "lisa-private-scanner",
+    binary,
+    ...argv,
+  ],
+});
+
 /** Audit the actual vendor Git children: Gitleaks can swallow their failures. */
 const auditedGit = scratch => {
   const environment = gitEnvironment();
@@ -244,8 +256,8 @@ export const scanCommits = (commits, cwd, requested, heads = []) => {
     const report = join(scratch, "report.json");
     const ignore = join(scratch, "ignore");
     writeFileSync(config, "[extend]\nuseDefault = true\n", { mode: 0o600 });
-    // Gitleaks truncates this existing file: its report keeps private mode even
-    // when the caller's umask would otherwise create world-readable metadata.
+    // Gitleaks removes and recreates this file; its dedicated child sets umask
+    // before vendor creation, while the caller's mask remains unchanged.
     writeFileSync(report, "[]", { mode: 0o600 });
     writeFileSync(ignore, "", { mode: 0o600 });
     // An isolated bare view excludes caller ignore files even in Git metadata.
@@ -272,41 +284,38 @@ export const scanCommits = (commits, cwd, requested, heads = []) => {
     for (let offset = 0; offset < commits.length; offset += 100) {
       const group = commits.slice(offset, offset + 100);
       audit.begin();
-      const result = spawnSync(
-        scanner,
-        [
-          "git",
-          source,
-          "--config",
-          config,
-          "--gitleaks-ignore-path",
-          ignore,
-          "--ignore-gitleaks-allow",
-          "--redact=100",
-          "--no-banner",
-          "--no-color",
-          "--log-level",
-          "error",
-          "--platform",
-          "none",
-          "--exit-code",
-          "42",
-          "--timeout",
-          "120",
-          "--report-format",
-          "json",
-          "--report-path",
-          report,
-          "--log-opts",
-          `--no-walk=unsorted --root --diff-merges=separate --no-ext-diff --no-textconv --no-renames ${group.join(" ")}`,
-        ],
-        {
-          cwd: scratch,
-          env: audit.environment,
-          timeout: 130000,
-          maxBuffer: 16 * 1024 * 1024,
-        }
-      );
+      const invocation = scannerInvocation(scanner, [
+        "git",
+        source,
+        "--config",
+        config,
+        "--gitleaks-ignore-path",
+        ignore,
+        "--ignore-gitleaks-allow",
+        "--redact=100",
+        "--no-banner",
+        "--no-color",
+        "--log-level",
+        "error",
+        "--platform",
+        "none",
+        "--exit-code",
+        "42",
+        "--timeout",
+        "120",
+        "--report-format",
+        "json",
+        "--report-path",
+        report,
+        "--log-opts",
+        `--no-walk=unsorted --root --diff-merges=separate --no-ext-diff --no-textconv --no-renames ${group.join(" ")}`,
+      ]);
+      const result = spawnSync(invocation.binary, invocation.argv, {
+        cwd: scratch,
+        env: audit.environment,
+        timeout: 130000,
+        maxBuffer: 16 * 1024 * 1024,
+      });
       if (
         result.error ||
         result.signal ||

package/all/copy-overwrite/scripts/lib/npm-update-gate.mjs

@@ -42,6 +42,7 @@ import {
   ordinaryGateReceipt,
 } from "./npm-update-publication.mjs";
 import { executeCanonicalHelper } from "./npm-update-controller-factory.mjs";
+import { withStage } from "./npm-update-invariants.mjs";
 
 const BOT = "github-actions[bot]";
 const MAIL = "41898282+github-actions[bot]@users.noreply.github.com";
@@ -143,7 +144,7 @@ export async function descriptorFor({
 async function stageProposal(context, env) {
   const { cwd, proposal } = context;
   const command = args => git(cwd, env, args, undefined, context.deadline);
-  await baseline(cwd, env, proposal);
+  await withStage("gate-baseline", () => baseline(cwd, env, proposal));
   const parent = (await command(["rev-parse", "HEAD"])).stdout
     .toString()
     .trim();
@@ -154,8 +155,12 @@ async function stageProposal(context, env) {
   );
   const branch = `lisa/npm-${proposal.key}`;
   await command(["checkout", "-b", branch]);
-  await executeCanonicalHelper(context, "stage-read", "link");
-  await executeCanonicalHelper(context, "stage-read", "attach-branch");
+  await withStage("gate-link", () =>
+    executeCanonicalHelper(context, "stage-read", "link")
+  );
+  await withStage("gate-attach", () =>
+    executeCanonicalHelper(context, "stage-read", "attach-branch")
+  );
   for (const file of FILES)
     writeFileSync(join(cwd, file), proposal.files[file]);
   await command(["add", "--", ...FILES]);
@@ -263,38 +268,50 @@ async function pushProposal(context, env, branch, object) {
 export async function gateProposal(context) {
   const scoped = { ...context, deadline: Date.now() + 1_800_000 };
   const { proposal, policy, token, preview } = context;
-  validateProposal(proposal, policy);
-  assertHostedGate(context);
-  validateGateProof(context);
-  required(
-    typeof token === "string" && token.length > 0,
-    "readonly gate token is absent"
-  );
-  return withPrivateRoot(async root => {
-    const env = {
-      ...candidateEnvironment(root),
-      GIT_AUTHOR_NAME: BOT,
-      GIT_AUTHOR_EMAIL: MAIL,
-      GIT_COMMITTER_NAME: BOT,
-      GIT_COMMITTER_EMAIL: MAIL,
-      GIT_AUTHOR_DATE: `${preview.epoch} +0000`,
-      GIT_COMMITTER_DATE: `${preview.epoch} +0000`,
-    };
-    const branch = await stageProposal(scoped, env);
-    const message = await installGateProof(context, root, args =>
-      git(context.cwd, env, args, undefined, scoped.deadline)
+  await withStage("gate-validate", () => {
+    validateProposal(proposal, policy);
+    assertHostedGate(context);
+    validateGateProof(context);
+    required(
+      typeof token === "string" && token.length > 0,
+      "readonly gate token is absent"
     );
-    const hosted = await createHostedGate(scoped, root, env);
-    try {
-      const gated = { ...scoped, hookInstallation: hosted.installation };
-      const object = await committedProposal(
-        gated,
-        { ...hosted.env, LISA_NPM_HOOK_ROLE: "commit" },
-        message
-      );
-      return await pushProposal(gated, hosted.env, branch, object);
-    } finally {
-      await hosted.close();
-    }
   });
+  return withStage("gate-scratch", () =>
+    withPrivateRoot(async root => {
+      const env = {
+        ...candidateEnvironment(root),
+        GIT_AUTHOR_NAME: BOT,
+        GIT_AUTHOR_EMAIL: MAIL,
+        GIT_COMMITTER_NAME: BOT,
+        GIT_COMMITTER_EMAIL: MAIL,
+        GIT_AUTHOR_DATE: `${preview.epoch} +0000`,
+        GIT_COMMITTER_DATE: `${preview.epoch} +0000`,
+      };
+      const branch = await withStage("gate-stage", () =>
+        stageProposal(scoped, env)
+      );
+      const proofGit = args =>
+        git(context.cwd, env, args, undefined, scoped.deadline);
+      const message = await withStage("gate-proof", () =>
+        installGateProof(context, root, proofGit)
+      );
+      const hosted = await createHostedGate(scoped, root, env);
+      try {
+        const gated = { ...scoped, hookInstallation: hosted.installation };
+        const object = await withStage("gate-commit", () =>
+          committedProposal(
+            gated,
+            { ...hosted.env, LISA_NPM_HOOK_ROLE: "commit" },
+            message
+          )
+        );
+        return await withStage("gate-push", () =>
+          pushProposal(gated, hosted.env, branch, object)
+        );
+      } finally {
+        await withStage("gate-close", () => hosted.close());
+      }
+    })
+  );
 }

package/all/copy-overwrite/scripts/lib/npm-update-hosted-gate.mjs

@@ -5,6 +5,7 @@
 import {
   existsSync,
   lstatSync,
+  realpathSync,
   readFileSync,
   mkdirSync,
   writeFileSync,
@@ -12,7 +13,7 @@ import {
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { required } from "./npm-update-contract.mjs";
-import { runProcess, writeJson } from "./npm-update-process.mjs";
+import { readBytes, runProcess, writeJson } from "./npm-update-process.mjs";
 import { qualifiedControllerGraph } from "./npm-update-helper.mjs";
 import {
   controllerTools,
@@ -20,6 +21,7 @@ import {
 } from "./npm-update-controller-factory.mjs";
 import { startHookReadBroker } from "./npm-update-hook-provider.mjs";
 import { originalHookInstallation } from "./npm-update-hook-installation.mjs";
+import { withStage } from "./npm-update-invariants.mjs";
 import {
   sha256,
   PROPOSAL_PREDICATE,
@@ -109,18 +111,45 @@ async function installHostedDependencies(context, root, env) {
   return installed;
 }
 
+/** Husky 8 declares its real installer in package metadata; dependency install remains script-disabled. */
+function huskyInstaller(cwd) {
+  const root = join(cwd, "node_modules/husky");
+  const metadata = JSON.parse(
+    readBytes(join(root, "package.json"), 65_536, false)
+  );
+  const bin =
+    typeof metadata.bin === "string" ? metadata.bin : metadata.bin?.husky;
+  required(
+    metadata.name === "husky" &&
+      /^8\.\d+\.\d+$/.test(metadata.version) &&
+      typeof bin === "string" &&
+      /^(?:[A-Za-z0-9_-]+\/)*[A-Za-z0-9_-]+\.js$/.test(bin),
+    "original Husky 8 installer declaration is unsupported"
+  );
+  const path = join(root, bin);
+  required(
+    realpathSync(root) === root &&
+      realpathSync(path) === path &&
+      lstatSync(path).isFile(),
+    "original Husky installer is unavailable or aliased"
+  );
+  return path;
+}
+
 /** The original supported manager installs its own wrappers; no synthetic replacement hook is written. */
 async function installOriginalManager(context, env) {
   const lefthook = existsSync(join(context.cwd, "lefthook.yml"));
   if (lefthook)
     await nativeStep(context, env, "bundle", ["exec", "lefthook", "install"]);
   else {
-    const husky = join(context.cwd, "node_modules/husky/bin.js");
     required(
-      existsSync(husky) && existsSync(join(context.cwd, ".husky/pre-push")),
+      existsSync(join(context.cwd, ".husky/pre-push")),
       "original hook manager installation is unavailable"
     );
-    await nativeStep(context, env, process.execPath, [husky]);
+    await nativeStep(context, env, process.execPath, [
+      huskyInstaller(context.cwd),
+      "install",
+    ]);
   }
   const git = args => nativeStep(context, env, "/usr/bin/git", args);
   const result = await git(["rev-parse", "--git-path", "hooks"]);
@@ -206,22 +235,9 @@ function nodeGateway(root, context) {
   return bin;
 }
 
-/** A separate read-only capability is available during original gates; it cannot acquire publisher/issuer permissions. */
-export async function createHostedGate(context, root, env) {
-  assertHostedGate(context);
-  const native = controllerTools(context.config.automationProvenance);
-  const graph = await qualifiedControllerGraph(context.cwd, context.config, [
-    "lisa-work-item.mjs",
-    "lisa-automation-provenance.mjs",
-    "lisa-rails-prepush.mjs",
-    "lib/npm-update-hosted-hook.mjs",
-    "lib/npm-update-hook-preload.mjs",
-  ]);
-  const installed = await installHostedDependencies(context, root, env);
-  const installation = await installOriginalManager(context, installed);
-  const scope = await proofScope(context, installed);
-  mkdirSync(join(root, "gh-config"), { mode: 0o700 });
-  const profile = {
+/** The unchanged read-only subject is constructed separately so diagnostic wrapping stays within function budgets. */
+function hookProfile(context, root, native, scope) {
+  return {
     version: 1,
     deadline: context.deadline,
     cwd: context.cwd,
@@ -239,16 +255,50 @@ export async function createHostedGate(context, root, env) {
       scope.proofs
     ),
   };
-  const broker = await startHookReadBroker(profile, context.token);
+}
+
+/** A separate read-only capability is available during original gates; it cannot acquire publisher/issuer permissions. */
+export async function createHostedGate(context, root, env) {
+  await withStage("gate-validate", () => assertHostedGate(context));
+  const native = await withStage("gate-tools", () =>
+    controllerTools(context.config.automationProvenance)
+  );
+  const graph = await withStage("gate-graph", () =>
+    qualifiedControllerGraph(context.cwd, context.config, [
+      "lisa-work-item.mjs",
+      "lisa-automation-provenance.mjs",
+      "lisa-rails-prepush.mjs",
+      "lib/npm-update-hosted-hook.mjs",
+      "lib/npm-update-hook-preload.mjs",
+    ])
+  );
+  const installed = await withStage("gate-install", () =>
+    installHostedDependencies(context, root, env)
+  );
+  const installation = await withStage("gate-hooks", () =>
+    installOriginalManager(context, installed)
+  );
+  const scope = await withStage("gate-scope", () =>
+    proofScope(context, installed)
+  );
+  const profile = await withStage("gate-scope", () => {
+    mkdirSync(join(root, "gh-config"), { mode: 0o700 });
+    return hookProfile(context, root, native, scope);
+  });
+  const broker = await withStage("gate-broker", () =>
+    startHookReadBroker(profile, context.token)
+  );
   try {
-    const bin = nodeGateway(root, {
-      version: 1,
-      root,
-      cwd: context.cwd,
-      graph,
-      native,
-      reader: { root, path: broker.path, deadline: context.deadline },
-    });
+    const bin = await withStage("gate-gateway", () =>
+      nodeGateway(root, {
+        version: 1,
+        root,
+        cwd: context.cwd,
+        graph,
+        native,
+        reader: { root, path: broker.path, deadline: context.deadline },
+      })
+    );
     return {
       installation,
       env: {
@@ -266,7 +316,7 @@ export async function createHostedGate(context, root, env) {
       close: broker.close,
     };
   } catch (error) {
-    await broker.close();
+    await withStage("gate-close", () => broker.close());
     throw error;
   }
 }

package/all/copy-overwrite/scripts/lib/npm-update-invariants.mjs

@@ -2,6 +2,103 @@
 // Do not edit directly — durable changes belong upstream in Lisa.
 
 /** Pure shared diagnostics retain one error identity without importing producer orchestration. */
+const stages = new Set([
+  "configuration",
+  "gate-input",
+  "gate-validate",
+  "gate-scratch",
+  "gate-stage",
+  "gate-baseline",
+  "gate-link",
+  "gate-attach",
+  "gate-proof",
+  "gate-tools",
+  "gate-graph",
+  "gate-install",
+  "gate-hooks",
+  "gate-scope",
+  "gate-broker",
+  "gate-gateway",
+  "gate-commit",
+  "gate-push",
+  "gate-close",
+  "gate-output",
+]);
+const diagnostics = new WeakMap();
+const signals = new Set([
+  "SIGTERM",
+  "SIGINT",
+  "SIGKILL",
+  "SIGHUP",
+  "SIGQUIT",
+  "SIGABRT",
+  "SIGPIPE",
+  "SIGSEGV",
+  "SIGBUS",
+  "SIGILL",
+  "SIGTRAP",
+  "SIGFPE",
+]);
+const errnos = new Set([
+  "EACCES",
+  "ENOENT",
+  "ENOEXEC",
+  "EMFILE",
+  "ENFILE",
+  "EAGAIN",
+  "EIO",
+  "EPIPE",
+]);
+const categories = new Set([
+  "exit",
+  "signal",
+  "cancelled",
+  "deadline",
+  "output-bound",
+  "input-failed",
+  "spawn-error",
+]);
+
+/** Nested stages preserve the innermost observed boundary and the exact original thrown value. */
+export async function withStage(stage, operation) {
+  required(stages.has(stage), "invalid updater diagnostic stage");
+  try {
+    return await operation();
+  } catch (error) {
+    if (
+      error !== null &&
+      (typeof error === "object" || typeof error === "function")
+    ) {
+      const prior = diagnostics.get(error) ?? {};
+      diagnostics.set(error, { ...prior, stage: prior.stage ?? stage });
+    }
+    throw error;
+  }
+}
+
+/** Only native capture registers observed close facts; exception properties never establish provenance. */
+export function recordNativeFailure(error, category, status, signal, errno) {
+  diagnostics.set(error, {
+    ...diagnostics.get(error),
+    native: categories.has(category) ? category : "unknown",
+    status:
+      Number.isInteger(status) && status >= 0 && status <= 255 ? status : null,
+    signal: signals.has(signal) ? signal : null,
+    errno: errnos.has(errno) ? errno : null,
+  });
+}
+
+/** Never inspect arbitrary messages, stacks, getters, commands, paths or captured child output. */
+export function publicFailure(error) {
+  const facts = diagnostics.get(error);
+  const parts = [`stage=${facts?.stage ?? "unknown"}`];
+  if (facts?.native) {
+    parts.push(`native=${facts.native}`, `status=${facts.status ?? "null"}`);
+    if (facts.signal) parts.push(`signal=${facts.signal}`);
+    if (facts.errno) parts.push(`errno=${facts.errno}`);
+  }
+  return `npm updater failed: required policy, authorization, installation, gate or exact publication evidence was unavailable (${parts.join(" ")})`;
+}
 
 /** Only trusted static boundary reasons may leave a phase as a public diagnostic. */
 export class UpdaterError extends Error {

package/all/copy-overwrite/scripts/lib/npm-update-native-process.mjs

@@ -5,6 +5,7 @@
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { required } from "./npm-update-contract.mjs";
+import { recordNativeFailure } from "./npm-update-invariants.mjs";
 
 /** The complete supervisor vector, including its control overhead, is bounded literal data. */
 function supervisedArguments(vector) {
@@ -104,27 +105,37 @@ function captureProcess(
     const errors = [];
     let size = 0;
     let failure;
+    let category;
+    let errno;
     let closed = false;
-    const stop = reason => {
-      failure ??= new Error(`npm updater: ${reason}`);
+    const stop = (reason, kind) => {
+      if (!failure) {
+        failure = new Error(`npm updater: ${reason}`);
+        category = kind;
+      }
       if (!closed && child.pid) child.kill("SIGTERM");
     };
-    const abort = () => stop("child was cancelled");
+    const abort = () => stop("child was cancelled", "cancelled");
     abortSignal?.addEventListener("abort", abort, { once: true });
     if (abortSignal?.aborted) abort();
-    const timer = setTimeout(() => stop("child exceeded deadline"), timeout);
+    const timer = setTimeout(
+      () => stop("child exceeded deadline", "deadline"),
+      timeout
+    );
     const collect = target => data => {
       size += data.length;
-      if (size > maximum) stop("child output exceeded bound");
+      if (size > maximum) stop("child output exceeded bound", "output-bound");
       else target.push(data);
     };
     child.stdout.on("data", collect(chunks));
     child.stderr.on("data", collect(errors));
     child.on("error", error => {
       failure = error;
+      category = "spawn-error";
+      errno = error.code;
     });
     child.stdin.on("error", error => {
-      if (error.code !== "EPIPE") stop("child input failed");
+      if (error.code !== "EPIPE") stop("child input failed", "input-failed");
     });
     child.stdin.end(input);
     child.on("close", (code, signal) => {
@@ -134,6 +145,13 @@ function captureProcess(
       if (failure || signal || !allowed.includes(code)) {
         const error =
           failure ?? new Error(`npm updater: child failed (${code ?? signal})`);
+        recordNativeFailure(
+          error,
+          category ?? (signal ? "signal" : "exit"),
+          code,
+          signal,
+          errno
+        );
         reject(
           Object.assign(error, {
             stdout: Buffer.concat(chunks),

package/all/copy-overwrite/scripts/lib/npm-update-publish.mjs

@@ -17,7 +17,6 @@ import { descriptorFor } from "./npm-update-gate.mjs";
 import { assertGateTransport } from "./npm-update-gate-hooks.mjs";
 import {
   publicationBody,
-  assertPublicationPolicy,
   publicationBacklink,
   publicationProof,
 } from "./npm-update-publication.mjs";
@@ -188,9 +187,6 @@ export async function publishProposal({
     return issue;
   };
   await authorize();
-  assertPublicationPolicy(
-    await api.request(`repos/${policy.repository}/actions/permissions/workflow`)
-  );
   await publicationObjects(
     cwd,
     proposal,

package/all/copy-overwrite/scripts/lisa-npm-updater.mjs

@@ -11,11 +11,11 @@ import { join, resolve } from "node:path";
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 import {
   required,
-  UpdaterError,
   keys,
   validatePolicy,
   validateProposal,
 } from "./lib/npm-update-contract.mjs";
+import { publicFailure, withStage } from "./lib/npm-update-invariants.mjs";
 import {
   readJson,
   writeJson,
@@ -119,6 +119,32 @@ async function publishPhase(
   process.stdout.write(`${result.status} ${result.url}\n`);
 }
 
+/** Gate input/output classification preserves the original orchestration and authority order. */
+async function gatePhase(
+  cwd,
+  output,
+  proposal,
+  policy,
+  config,
+  allocation,
+  preview
+) {
+  const result = await gateProposal({
+    cwd,
+    proposal,
+    policy,
+    allocation,
+    preview,
+    ...(await withStage("gate-input", () => readGateProof(output))),
+    token: process.env.GH_TOKEN,
+    config,
+  });
+  await withStage("gate-output", () =>
+    writeJson(join(output, "gated.json"), result)
+  );
+  process.stdout.write(`gated ${result.receipt.commit}\n`);
+}
+
 /** Strict phase and fixed directory arguments are data, never a caller recipe. */
 export async function main(argv = process.argv.slice(2)) {
   required(
@@ -131,7 +157,9 @@ export async function main(argv = process.argv.slice(2)) {
   const [phase, checkout, directory] = argv;
   const cwd = resolve(checkout);
   const output = resolve(directory);
-  const { config, policy } = await configuration(cwd);
+  const { config, policy } = await withStage("configuration", () =>
+    configuration(cwd)
+  );
   phaseDirectory(output);
   if (phase === "prepare") {
     const result = await prepareUpdate({ cwd, policy, config });
@@ -168,21 +196,16 @@ export async function main(argv = process.argv.slice(2)) {
     process.stdout.write(`${result.mode} checkpoint complete\n`);
     return;
   }
-  if (phase === "gate") {
-    const result = await gateProposal({
+  if (phase === "gate")
+    return gatePhase(
       cwd,
+      output,
       proposal,
       policy,
-      allocation,
-      preview,
-      ...readGateProof(output),
-      token: process.env.GH_TOKEN,
       config,
-    });
-    writeJson(join(output, "gated.json"), result);
-    process.stdout.write(`gated ${result.receipt.commit}\n`);
-    return;
-  }
+      allocation,
+      preview
+    );
   return publishPhase(
     cwd,
     output,
@@ -197,8 +220,6 @@ export async function main(argv = process.argv.slice(2)) {
 if (invokedAsScript(import.meta.url))
   main().catch(error => {
     // Never print candidate/provider payloads or child output that may contain credentials.
-    process.stderr.write(
-      `${error instanceof UpdaterError ? error.message : "npm updater failed: required policy, authorization, installation, gate or exact publication evidence was unavailable"}\n`
-    );
+    process.stderr.write(`${publicFailure(error)}\n`);
     process.exitCode = 1;
   });