@codyswann/lisa 4.72.6 → 4.73.0

package/all/copy-overwrite/scripts/lib/history-secret-evidence.mjs

@@ -9,12 +9,15 @@ import {
   HistorySecretError,
 } from "./history-secret-git.mjs";
 import {
+  coordinateManifest,
+  coordinateMaps,
   evidenceMaps,
-  narrativeSpan,
+  paragraphNarrativeSpan,
   safeSourcePath,
 } from "./history-secret-evidence-shape.mjs";
 const BUDGET = 64 * 1024 * 1024;
 const NO_REPLACEMENTS = "--no-replace-objects";
+const LITERAL_PATHSPECS = "--literal-pathspecs";
 const digest = bytes => createHash("sha256").update(bytes).digest("hex");
 const options = cwd => ({
   cwd,
@@ -27,7 +30,7 @@ const options = cwd => ({
 const readBlob = (file, commit, cwd, state) => {
   if (!safeSourcePath(file)) return null;
   const entries = gitRead(
-    ["--literal-pathspecs", "ls-tree", "-z", commit, "--", file],
+    [LITERAL_PATHSPECS, "ls-tree", "-z", commit, "--", file],
     cwd
   )
     .split("\0")
@@ -116,7 +119,7 @@ const sourceVersions = (file, row, cwd, commits, cache) => {
   for (let offset = 0; offset < commits.length; offset += 100) {
     const list = gitRead(
       [
-        "--literal-pathspecs",
+        LITERAL_PATHSPECS,
         "log",
         "--no-walk=unsorted",
         "--format=%H",
@@ -224,12 +227,156 @@ const verifiedMap = (map, row, cwd, commits, heads, blob, versions) => {
   return map.spans;
 };
 
+const coordinateKey = origin =>
+  JSON.stringify([
+    origin.commit,
+    origin.blob,
+    origin.path,
+    origin.format,
+    origin.map_pointer,
+    ...origin.value_span,
+  ]);
+const blobIdentity = (bytes, width) =>
+  createHash(width === 40 ? "sha1" : "sha256")
+    .update(`blob ${bytes.length}\0`)
+    .update(bytes)
+    .digest("hex");
+
+/** Discover only sidecar snapshots in the original selected commit set. */
+const selectedCoordinates = (cwd, commits, blob) => {
+  const path = ".lisa/history-secret-evidence.json";
+  const candidates = new Set();
+  for (let offset = 0; offset < commits.length; offset += 100) {
+    const list = gitRead(
+      [
+        LITERAL_PATHSPECS,
+        "log",
+        "--no-walk=unsorted",
+        "--format=%H",
+        ...commits.slice(offset, offset + 100),
+        "--",
+        path,
+      ],
+      cwd
+    );
+    for (const commit of list.split("\n").filter(Boolean)) {
+      if (!commits.includes(commit))
+        throw new HistorySecretError(
+          "Evidence selection is invalid; safety is unproved."
+        );
+      candidates.add(commit);
+    }
+  }
+  if (!candidates.size) return { present: false, entries: new Map() };
+  const snapshots = new Map();
+  for (const commit of candidates) {
+    const exists = gitRead(
+      [LITERAL_PATHSPECS, "ls-tree", "--name-only", commit, "--", path],
+      cwd
+    );
+    if (!exists) continue;
+    const bytes = blob(path, commit);
+    if (bytes === null) return { present: true, entries: null };
+    snapshots.set(blobIdentity(bytes, commit.length), bytes);
+  }
+  if (!snapshots.size) return { present: false, entries: new Map() };
+  if (snapshots.size !== 1) return { present: true, entries: null };
+  const entries = coordinateManifest(
+    [...snapshots.values()][0],
+    commits[0].length
+  );
+  if (entries === null) return { present: true, entries: null };
+  const indexed = new Map();
+  const spans = new Map();
+  const documents = new Set();
+  for (const entry of entries) {
+    if (!commits.includes(entry.origin.commit))
+      return { present: true, entries: null };
+    const key = coordinateKey(entry.origin);
+    const file = JSON.stringify([
+      entry.origin.commit,
+      entry.origin.blob,
+      entry.origin.path,
+    ]);
+    const intervals = spans.get(file) ?? [];
+    const [start, end] = entry.origin.value_span;
+    if (indexed.has(key) || intervals.some(([a, b]) => start < b && end > a))
+      return { present: true, entries: null };
+    intervals.push([start, end]);
+    spans.set(file, intervals);
+    indexed.set(key, entry.preimage);
+    documents.add(JSON.stringify([entry.origin.commit, entry.origin.path]));
+  }
+  return { present: true, entries: indexed, documents };
+};
+
+/** Explicit and typed ancestor claims require independent original commit verification. */
+const coordinateRevision = (map, preimage, row, cwd) => {
+  const hasTyped = Object.hasOwn(map.value, "commit_parent");
+  const typed = map.value.commit_parent;
+  if (
+    hasTyped &&
+    Object.hasOwn(preimage, "commit") &&
+    typed !== preimage.commit
+  )
+    return null;
+  if (!hasTyped && !Object.hasOwn(preimage, "commit")) return row.Commit;
+  const revision = hasTyped ? typed : preimage.commit;
+  return revisionFor({ value: { source_revision: revision } }, row, cwd);
+};
+
+/** Every literal, including unflagged siblings, needs its own exact coordinate and preimage. */
+const verifiedCoordinateMap = (
+  map,
+  row,
+  bytes,
+  coordinates,
+  cwd,
+  selected,
+  blob
+) => {
+  if (coordinates === null) return [];
+  const identity = blobIdentity(bytes, row.Commit.length);
+  for (const span of map.spans) {
+    const preimage = coordinates.get(
+      coordinateKey({
+        commit: row.Commit,
+        blob: identity,
+        path: row.File,
+        format: map.format,
+        map_pointer: map.pointer,
+        value_span: [span.start, span.end],
+      })
+    );
+    if (
+      !preimage ||
+      bytes.subarray(span.start, span.end).toString("ascii") !== span.hash
+    )
+      return [];
+    let original;
+    if (map.kind === "proof") {
+      if (preimage.kind !== "archive" || !selected.has(preimage.commit))
+        return [];
+      original = blob(preimage.path, preimage.commit);
+    } else {
+      if (preimage.kind !== "source") return [];
+      const revision = coordinateRevision(map, preimage, row, cwd);
+      if (revision === null) return [];
+      original = blob(span.file, revision);
+    }
+    if (original === null || digest(original) !== span.hash) return [];
+  }
+  return map.spans;
+};
+
 /** Clear a finding only after syntax, original span and independently verified bytes agree. */
 export const classifyEvidence = (cwd, commits, heads) => {
   const state = { remaining: BUDGET, blobs: new Map() };
   const refs = new Map();
   const maps = new Map();
   const versions = new Map();
+  const selected = new Set(commits);
+  let coordinates;
   const blob = (file, commit) => {
     const key = `${commit}\0${file}`;
     if (!refs.has(key)) {
@@ -241,6 +388,7 @@ export const classifyEvidence = (cwd, commits, heads) => {
   return row => {
     if (
       row.RuleID !== "generic-api-key" ||
+      !selected.has(row.Commit) ||
       !safeSourcePath(row.File) ||
       row.SymlinkFile !== "" ||
       row.Secret !== "REDACTED" ||
@@ -256,15 +404,35 @@ export const classifyEvidence = (cwd, commits, heads) => {
     if (!bytes) return false;
     const span = attribution(row, bytes);
     if (!span) return false;
-    const narrative = narrativeSpan(bytes, span.lineStart, span.lineEnd);
+    const narrative = paragraphNarrativeSpan(
+      bytes,
+      span.lineStart,
+      span.lineEnd
+    );
     if (narrative !== null && span.matches(narrative)) return true;
     const key = `${row.Commit}\0${row.File}`;
+    if (coordinates === undefined)
+      coordinates = selectedCoordinates(cwd, commits, blob);
     if (!maps.has(key))
       maps.set(
         key,
-        evidenceMaps(bytes).flatMap(map =>
-          verifiedMap(map, row, cwd, commits, heads, blob, versions)
-        )
+        coordinates.present &&
+          (coordinates.entries === null ||
+            coordinates.documents.has(JSON.stringify([row.Commit, row.File])))
+          ? coordinateMaps(bytes).flatMap(map =>
+              verifiedCoordinateMap(
+                map,
+                row,
+                bytes,
+                coordinates.entries,
+                cwd,
+                selected,
+                blob
+              )
+            )
+          : evidenceMaps(bytes).flatMap(map =>
+              verifiedMap(map, row, cwd, commits, heads, blob, versions)
+            )
       );
     return maps.get(key).filter(span.matches).length === 1;
   };

package/all/copy-overwrite/scripts/lib/npm-update-cancel-origin.mjs

@@ -34,6 +34,7 @@ import {
 import {
   DESCRIPTOR_KEYS,
   optionalLockFields,
+  optionalRuntimeFields,
 } from "./automation-provenance-contract.mjs";
 
 /** Only complete, digest-checked transport is considered; incomplete chunks grant nothing. */
@@ -181,7 +182,11 @@ export function originalDescriptor(checkpoint, old, allocation, authority) {
   const preview = checkpoint.payload.preview;
   keys(preview, ["descriptor", "message", "epoch"]);
   const d = preview.descriptor;
-  keys(d, [...DESCRIPTOR_KEYS, ...optionalLockFields(old)]);
+  keys(d, [
+    ...DESCRIPTOR_KEYS,
+    ...optionalLockFields(old),
+    ...optionalRuntimeFields(old),
+  ]);
   required(
     d.version === 1 &&
       d.parent === old.parent &&
@@ -193,6 +198,7 @@ export function originalDescriptor(checkpoint, old, allocation, authority) {
       d.policySha256 === sha256(canonicalJson(authority)) &&
       canonicalJson(d.files) === canonicalJson(old.hashes) &&
       d.bunLockSha256 === old.bunLockSha256 &&
+      d.runtimeSha256 === old.runtimeSha256 &&
       canonicalJson(d.updates) === canonicalJson(old.updates) &&
       typeof preview.message === "string" &&
       sha256(preview.message) === d.messageSha256 &&

package/all/copy-overwrite/scripts/lib/npm-update-contract.mjs

@@ -12,9 +12,12 @@ import { canonicalJson } from "../lisa-automation-provenance.mjs";
 import { sha256 } from "./github-attestation-verifier.mjs";
 import {
   optionalLockFields,
+  optionalRuntimeFields,
   proposalFileNames,
+  signedProposalFields,
 } from "./automation-provenance-contract.mjs";
 export { proposalFileNames } from "./automation-provenance-contract.mjs";
+import { runtimeBinding } from "./npm-update-rails-runtime-contract.mjs";
 
 export const FILES = ["package-lock.json", "package.json"];
 export const SECTIONS = [
@@ -24,72 +27,10 @@ export const SECTIONS = [
 ];
 export const CLAIM =
   "[lisa-tracker-claim] Claimed by Lisa. Starting implementation.";
-export const NAME = /^(?:@[a-z0-9][a-z0-9_.-]*\/)?[a-z0-9][a-z0-9_.-]*$/;
-export const VERSION =
-  /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[A-Za-z0-9.-]+)?$/;
+export { NAME, VERSION, validatePolicy } from "./npm-update-policy.mjs";
+import { VERSION } from "./npm-update-policy.mjs";
 export const OBJECT = /^[a-f0-9]{40}$/;
 
-/** Configured tracking and an explicit owner are prerequisites, never inferred. */
-export function validatePolicy(value, config) {
-  keys(value, [
-    "version",
-    "repository",
-    "directory",
-    "target",
-    "maintainer",
-    "packages",
-    "lisaOwner",
-  ]);
-  required(
-    value.version === 1 && value.directory === "." && value.target === "main",
-    "only root npm on main is supported"
-  );
-  required(
-    config.tracker === "github" &&
-      value.repository === `${config.github?.org}/${config.github?.repo}`,
-    "configured repository/tracker differs"
-  );
-  required(
-    /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(value.repository),
-    "invalid repository"
-  );
-  required(
-    typeof value.maintainer === "string" &&
-      /^[A-Za-z0-9][A-Za-z0-9-]{0,38}$/.test(value.maintainer),
-    "explicit assignable maintainer required"
-  );
-  required(
-    ["absent", "verified-local-full-apply"].includes(value.lisaOwner),
-    "Lisa requires a verified local full-apply owner"
-  );
-  required(
-    Array.isArray(value.packages) &&
-      value.packages.length > 0 &&
-      value.packages.length <= 64,
-    "invalid package selection"
-  );
-  const names = new Set();
-  for (const selection of value.packages) {
-    keys(selection, ["name", "version"]);
-    required(
-      typeof selection.name === "string" &&
-        selection.name.length <= 214 &&
-        NAME.test(selection.name),
-      "invalid npm name"
-    );
-    required(
-      typeof selection.version === "string" && VERSION.test(selection.version),
-      "exact registry version required"
-    );
-    required(
-      !names.has(selection.name) && selection.name !== "@codyswann/lisa",
-      "duplicate selection or Lisa version-only update"
-    );
-    names.add(selection.name);
-  }
-  return structuredClone(value);
-}
-
 /** Host declarations are checked before npm or lifecycle execution. */
 export function validateHost(before) {
   required(
@@ -221,7 +162,10 @@ export function proposalFrom(
   bunLockSha256
 ) {
   required(OBJECT.test(parent), "unsupported Git parent or object format");
-  const optional = bunLockSha256 === undefined ? {} : { bunLockSha256 };
+  const optional = {
+    ...(bunLockSha256 === undefined ? {} : { bunLockSha256 }),
+    ...runtimeBinding(policy),
+  };
   const names = proposalFileNames({ files, ...optional });
   for (const value of Object.values(files))
     required(
@@ -253,7 +197,7 @@ export function proposalFrom(
         repository: policy.repository,
         parent,
         updates: ordered,
-        ...optional,
+        ...signedProposalFields(optional),
       })
     ),
     before,
@@ -280,6 +224,7 @@ export function validateProposal(value, policy) {
     "files",
     "hashes",
     ...optionalLockFields(value),
+    ...optionalRuntimeFields(value),
   ]);
   const expected = proposalFrom(
     policy,

package/all/copy-overwrite/scripts/lib/npm-update-gate.mjs

@@ -128,6 +128,9 @@ export async function descriptorFor({
       ...(proposal.bunLockSha256 === undefined
         ? {}
         : { bunLockSha256: proposal.bunLockSha256 }),
+      ...(proposal.runtimeSha256 === undefined
+        ? {}
+        : { runtimeSha256: proposal.runtimeSha256 }),
       messageSha256: sha256(message),
       updates: proposal.updates,
       proposalKey: proposal.bindingKey,

package/all/copy-overwrite/scripts/lib/npm-update-helper-inventory.mjs

@@ -65,6 +65,7 @@ const PRODUCER = [
   "helper-inventory",
   "hosted-gate",
   "hosted-hook",
+  "hosted-scope",
   "hook-installation",
   "hook-preload",
   "hook-provider",
@@ -78,12 +79,21 @@ const PRODUCER = [
   "object",
   "orchestrator",
   "owner",
+  "policy",
   "prepare",
   "process",
   "process-core",
   "publication",
   "publish",
   "quality",
+  "rails-mysql",
+  "rails-mysql-daemon",
+  "rails-mysql-resource",
+  "rails-mysql-storage",
+  "rails-runtime-contract",
+  "rails-tool-downloads",
+  "rails-tool-identity",
+  "rails-tools",
   "recovery",
   "supersession",
   "runtime-archive",