@codyswann/lisa 4.73.0 → 4.73.2

package/all/copy-overwrite/scripts/lib/history-secret-git.mjs

@@ -44,12 +44,15 @@ export const gitEnvironment = () => {
   };
 };
 
+/** Replacement refs must never redirect which objects a proof reads. */
+const NO_REPLACE_OBJECTS = "--no-replace-objects";
+
 /** Git errors can contain arbitrary payloads; only authored guidance leaves here. */
-export const gitRead = (args, cwd) => {
+export const gitRead = (args, cwd, input) => {
   const result = spawnSync(
     "git",
     [
-      "--no-replace-objects",
+      NO_REPLACE_OBJECTS,
       "-c",
       "diff.external=",
       "-c",
@@ -60,6 +63,7 @@ export const gitRead = (args, cwd) => {
       cwd,
       env: gitEnvironment(),
       encoding: "utf8",
+      input,
       timeout: 120000,
       maxBuffer: 64 * 1024 * 1024,
     }
@@ -151,8 +155,143 @@ export const eventPairs = (event, name, width) => {
   );
 };
 
+/**
+ * Git configuration exactly as the push itself sees it.
+ *
+ * gitEnvironment pins configuration so history reads cannot be steered, which
+ * is right for walking objects and wrong for naming a destination: the push
+ * resolved its URL, `pushurl`, `pushInsteadOf` and credentials through user,
+ * system and environment configuration, and a destination resolved under any
+ * other configuration may be a different repository.
+ */
+const remoteEnvironment = () => {
+  const environment = gitEnvironment();
+  for (const key of Object.keys(environment))
+    if (key.startsWith("GIT_CONFIG")) delete environment[key];
+  for (const [key, value] of Object.entries(process.env))
+    if (key.startsWith("GIT_CONFIG") && value !== undefined)
+      environment[key] = value;
+  // Never wait on a person: no terminal prompt and no askpass program, so a
+  // destination that needs an unavailable credential fails at once.
+  return { ...environment, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "" };
+};
+
+/**
+ * Run one destination-resolution read under the push's own configuration.
+ * @param {string[]} args Git arguments.
+ * @param {string} cwd Repository directory.
+ * @returns {string | null} Trimmed stdout, or null when Git refused or failed.
+ */
+const remoteRead = (args, cwd) => {
+  const result = spawnSync("git", [NO_REPLACE_OBJECTS, ...args], {
+    cwd,
+    env: remoteEnvironment(),
+    encoding: "utf8",
+    timeout: 60000,
+    maxBuffer: 64 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "ignore"],
+  });
+  // probe-direction: fail-closed — every caller treats null as "the
+  // destination is unproved", which subtracts nothing from the scan.
+  if (result.error || result.signal || result.status !== 0) return null;
+  return result.stdout.trim();
+};
+
+/**
+ * The repository a push is actually going to, from Git's pre-push arguments.
+ *
+ * Git calls the hook with the remote's name (or the URL, when the push named
+ * no remote) and the URL it pushes to, already rewritten by `pushInsteadOf`.
+ * That URL is the destination, so it wins when present. A wrapper that
+ * forwards only a remote NAME gets that remote's push URL, resolved under the
+ * push's own configuration; a remote with several push URLs, or a bare URL
+ * with no `$2`, cannot be pinned to one destination and returns null. A value
+ * that looks like an option is never used.
+ * @param {string[]} remoteArgs Git's pre-push `$1` and `$2`, as forwarded.
+ * @param {string} cwd Repository directory.
+ * @returns {string | null} The destination, or null when it cannot be proved.
+ */
+export const pushDestination = (remoteArgs, cwd) => {
+  const [remote, url] = remoteArgs ?? [];
+  const usable = value =>
+    typeof value === "string" && value !== "" && !value.startsWith("-");
+  if (usable(url)) return url;
+  if (!usable(remote)) return null;
+  const names = (remoteRead(["remote"], cwd) ?? "").split("\n");
+  if (!names.includes(remote)) return null;
+  const urls = (
+    remoteRead(["remote", "get-url", "--push", "--all", "--", remote], cwd) ??
+    ""
+  )
+    .split("\n")
+    .filter(Boolean);
+  return urls.length === 1 ? urls[0] : null;
+};
+
+/**
+ * Commit IDs the push destination advertises right now that exist locally.
+ *
+ * Asked of the destination itself (`git ls-remote`), not read from local
+ * tracking refs: a tracking ref can outlive a branch deleted or reset on the
+ * remote, and with a separate pushurl it describes a different repository, so
+ * either would exclude commits the destination lacks. An advertised ID this
+ * repository does not have cannot bound a local walk and is dropped, which
+ * only ever widens the scan.
+ * @param {string | null} destination The push destination from pushDestination.
+ * @param {string} cwd Repository directory.
+ * @returns {string[]} IDs to exclude; empty when nothing could be proved.
+ */
+export const advertisedTips = (destination, cwd) => {
+  if (destination === null) return [];
+  // An `insteadOf` rule can rewrite even a URL Git already rewrote for the
+  // push, and then the probe would describe another repository. Trust the
+  // advertisement only when ls-remote would contact the destination itself.
+  // probe-direction: fail-closed — a URL that cannot be confirmed subtracts
+  // nothing.
+  if (
+    remoteRead(["ls-remote", "--get-url", "--", destination], cwd) !==
+    destination
+  )
+    return [];
+  const listed = spawnSync(
+    "git",
+    [NO_REPLACE_OBJECTS, "ls-remote", "--", destination],
+    {
+      cwd,
+      env: remoteEnvironment(),
+      encoding: "utf8",
+      timeout: 60000,
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "ignore"],
+    }
+  );
+  // probe-direction: fail-closed — a destination that cannot be asked
+  // advertises nothing, so nothing is subtracted and the complete history is
+  // scanned.
+  if (listed.error || listed.signal || listed.status !== 0) return [];
+  const advertised = [
+    ...new Set(
+      listed.stdout
+        .split("\n")
+        .map(line => line.split("\t")[0])
+        .filter(id => /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u.test(id))
+    ),
+  ];
+  if (advertised.length === 0) return [];
+  const present = gitRead(
+    ["cat-file", "--batch-check=%(objectname) %(objecttype)"],
+    cwd,
+    advertised.map(id => `${id}\n`).join("")
+  );
+  return present
+    .split("\n")
+    .map(line => line.split(" "))
+    .filter(([, type]) => type === "commit" || type === "tag")
+    .map(([id]) => id);
+};
+
 /** Pairwise subtraction prevents one ref's old tip from hiding another update. */
-export const introducedCommits = (pairs, cwd, width) => {
+export const introducedCommits = (pairs, cwd, width, remoteArgs = []) => {
   const oid = new RegExp(`^[a-f0-9]{${width}}$`, "u");
   for (const pair of pairs) {
     if (!oid.test(pair.before ?? "") || !oid.test(pair.after ?? ""))
@@ -175,6 +314,16 @@ export const introducedCommits = (pairs, cwd, width) => {
       "Legacy Git grafts prevent complete history proof. Use an unmodified complete repository checkout."
     );
   const commits = new Set();
+  // A new remote ref (zero `before`) has no old tip to subtract, and scanning
+  // everything reachable from it counts the remote's own published history as
+  // introduced: every new branch of an old repository then re-litigates its
+  // root commit. What a push introduces is what the destination does not
+  // already hold, so a new ref subtracts what the push destination advertises.
+  // Without a destination, or one that cannot be asked, nothing is subtracted
+  // and the complete reachable history is scanned as before.
+  const published = updates.some(pair => /^0+$/u.test(pair.before))
+    ? advertisedTips(pushDestination(remoteArgs, cwd), cwd)
+    : [];
   for (const { before, after } of updates) {
     const next = gitRead(["rev-parse", "--verify", `${after}^{commit}`], cwd);
     const previous = /^0+$/u.test(before)
@@ -190,9 +339,13 @@ export const introducedCommits = (pairs, cwd, width) => {
           "Required Git trees or blobs are missing. Fetch complete objects, repair the checkout and retry."
         );
     }
+    // Exclusions go through stdin: a remote can hold more refs than one
+    // command line carries.
+    const exclusions = previous ? [previous] : published;
     const list = gitRead(
-      ["rev-list", next, ...(previous ? [`^${previous}`] : [])],
-      cwd
+      ["rev-list", "--stdin", next],
+      cwd,
+      exclusions.map(oid => `^${oid}\n`).join("")
     );
     for (const commit of list.split("\n").filter(Boolean)) commits.add(commit);
   }

package/all/copy-overwrite/scripts/lib/npm-update-bun.mjs

@@ -112,7 +112,10 @@ export async function qualifiedBun(env, { executable, deadline } = {}) {
   return invoke;
 }
 
-/** Native JSONC parsing is data-only; every Bun package must match a public npm lock identity. */
+/**
+ * Native JSONC parsing is data-only; every Bun package must match a public npm lock identity.
+ * npm aliases record their real registry name separately from the installation path.
+ */
 export async function verifyBunLock(bun, app, options = {}) {
   const text = readBytes(join(app, "bun.lock"), 1_048_576, false);
   const parsed = await bun(
@@ -156,7 +159,8 @@ export async function verifyBunLock(bun, app, options = {}) {
     );
     const matching = nodes.some(
       ([path, node]) =>
-        row[0] === `${path.split("node_modules/").at(-1)}@${node.version}` &&
+        row[0] ===
+          `${node.name ?? path.split("node_modules/").at(-1)}@${node.version}` &&
         row[3] === node.integrity &&
         (row[1] === "" || row[1] === node.resolved)
     );

package/all/copy-overwrite/scripts/lib/npm-update-contract.mjs

@@ -109,7 +109,31 @@ export function validateLock(lock, manifest, updates) {
         !item.link,
       "unsupported lock node"
     );
-    const url = new URL(item.resolved);
+    // A bundled dependency ships inside its parent's tarball, so npm records
+    // no source or integrity of its own: the parent's registry integrity is
+    // what covers its bytes. Accept it only nested under a parent this loop
+    // also validates, and never when it claims a source of its own.
+    if (item.inBundle === true) {
+      required(
+        item.resolved === undefined && item.integrity === undefined,
+        "bundled lock node declares its own source"
+      );
+      const boundary = name.lastIndexOf("/node_modules/");
+      const parent = boundary < 0 ? "" : name.slice(0, boundary);
+      required(
+        parent.startsWith("node_modules/") &&
+          Object.hasOwn(lock.packages, parent),
+        "bundled lock node has no registry parent"
+      );
+      continue;
+    }
+    required(typeof item.resolved === "string", "registry source missing");
+    let url;
+    try {
+      url = new URL(item.resolved);
+    } catch {
+      required(false, "registry source unparseable");
+    }
     required(
       url.protocol === "https:" &&
         url.hostname === "registry.npmjs.org" &&

package/all/copy-overwrite/scripts/lisa-history-secrets.mjs

@@ -41,9 +41,23 @@ export const main = async (
     const scannerIndex = args.indexOf("--scanner");
     const scanner = scannerIndex < 0 ? undefined : args[scannerIndex + 1];
     const mode = args[0];
+    // Git hands a pre-push hook the remote's name (or URL) and URL as $1/$2.
+    // Both are optional so an older wrapper that forwards neither keeps the
+    // complete-history scan; neither may look like an option.
+    const remoteArgs =
+      mode === "pre-push"
+        ? args.slice(1, scannerIndex < 0 ? undefined : scannerIndex)
+        : [];
     const accepted =
       mode === "pre-push"
-        ? ["pre-push", ...(scanner ? ["--scanner", scanner] : [])]
+        ? [
+            "pre-push",
+            ...(remoteArgs.length <= 2 &&
+            remoteArgs.every(value => value !== "" && !value.startsWith("-"))
+              ? remoteArgs
+              : []),
+            ...(scanner ? ["--scanner", scanner] : []),
+          ]
         : [
             "ci",
             ...(args[1] === "--event"
@@ -56,7 +70,7 @@ export const main = async (
       !["pre-push", "ci"].includes(mode)
     )
       throw new HistorySecretError(
-        "Invalid scanner command. Use pre-push with actual stdin or ci --event <event-json> --event-name <push|pull_request>; optional --scanner <pinned-executable>."
+        "Invalid scanner command. Use pre-push [<remote> [<url>]] with actual stdin or ci --event <event-json> --event-name <push|pull_request>; optional --scanner <pinned-executable>."
       );
     const width = objectWidth(cwd);
     let pairs;
@@ -87,7 +101,7 @@ export const main = async (
         width
       );
     }
-    const commits = introducedCommits(pairs, cwd, width);
+    const commits = introducedCommits(pairs, cwd, width, remoteArgs);
     if (commits.length === 0) {
       console.log("No introduced history. Scanner was not run.");
       return 0;

package/all/copy-overwrite/scripts/lisa-hooks/block-blind-automerge.sh

@@ -211,6 +211,7 @@ if [ -z "$command_str" ]; then
 fi
 
 if ! BLOCK_BLIND_AUTOMERGE_COMMAND="$command_str" python3 - <<'PY'
+import io
 import json
 import os
 import re
@@ -244,7 +245,41 @@ MERGE_SEPARATE_VALUE = {
 
 COMMAND_SEPARATORS = {
     ";", "|", "||", "&", "&&", "(", ")", "<", ">", ">>", "<<", "&|",
+    # `|&` pipes stdout AND stderr into the next command, so it ends a command
+    # exactly as `|` does. shlex emits it as one token, and before it was listed
+    # here `echo hi |& git commit --no-verify` read as a single `echo` command
+    # whose arguments happened to include git. The case terminators end a
+    # command the same way.
+    "|&", ";;", ";&", ";;&",
 }
+# shlex also GLUES adjacent punctuation into one token across distinct
+# operators: `(echo hi)|&git ...` arrives as `)|&`, which no set membership
+# test can recognise. An operator-only token is therefore re-split into the
+# operators it is made of, longest first. Redirections are kept whole and are
+# deliberately NOT separators, so `git commit 2>&1 -n` keeps its `-n` inside the
+# commit's argv scope.
+OPERATOR_ONLY = re.compile(r"^[();<>|&]+$")
+SHELL_OPERATOR = re.compile("|".join(
+    re.escape(operator) for operator in sorted(
+        COMMAND_SEPARATORS | {">|", "&>", "&>>", ">&", "<&", "<>", "<<<"},
+        key=lambda operator: (-len(operator), operator),
+    )
+))
+
+
+def split_operators(token):
+    """Split a glued operator-only token into the shell operators it holds.
+
+    Args:
+        token: One shlex token that was not read inside a quote or escape.
+
+    Returns:
+        The operators, longest first, or the token itself when it is not
+        made only of shell punctuation.
+    """
+    if OPERATOR_ONLY.match(token):
+        return SHELL_OPERATOR.findall(token)
+    return [token]
 
 # Shell wrappers whose `-c` argument is a command in a string rather than argv.
 # The outer argv names bash, so the arming is invisible without recursing once.
@@ -422,12 +457,40 @@ def shell_tokens(text):
     Returns:
         The token list, with `;`, `|`, `&&`, `(` and friends standing alone.
     """
-    lexer = shlex.shlex(
-        line_boundaries_as_separators(text), posix=True, punctuation_chars=True
-    )
+    stream = OperatorStream(line_boundaries_as_separators(text))
+    lexer = shlex.shlex(stream, posix=True, punctuation_chars=True)
     lexer.whitespace_split = True
     lexer.commenters = ""
-    return list(lexer)
+    stream.lexer = lexer
+    tokens = []
+    while True:
+        stream.literal_operator = False
+        token = lexer.get_token()
+        if token is None:
+            return tokens
+        # Quoted punctuation is an argument, never a boundary: a branch can be
+        # named `|&`, and `gh pr merge '|&' --auto` must keep `--auto` in the
+        # merge's own argv. Only real operator runs are split.
+        if stream.literal_operator:
+            tokens.append(
+                chr(0) + token if token in COMMAND_SEPARATORS else token
+            )
+        else:
+            tokens.extend(split_operators(token))
+
+
+class OperatorStream(io.StringIO):
+    """Remember punctuation read while shlex is inside a quote or escape."""
+
+    lexer = None
+    literal_operator = False
+
+    def read(self, size=-1):
+        value = super().read(size)
+        if (self.lexer is not None and self.lexer.state in {"'", '"', chr(92)}
+                and any(char in "();|&<>" for char in value)):
+            self.literal_operator = True
+        return value
 
 
 def is_gh(token):
@@ -493,6 +556,22 @@ def arms_auto_merge(argv):
     return False
 
 
+def literal_value(token):
+    """The argument a token stands for, without the quoted-separator marker.
+
+    `shell_tokens` prefixes a QUOTED separator with NUL so no scan stops at it.
+    That marker is for boundary checks only: a value handed to a gh probe
+    (a selector, a base ref, a repo) must be the argument the shell passes.
+
+    Args:
+        token: One token from `shell_tokens`.
+
+    Returns:
+        The token as the shell would pass it.
+    """
+    return token[1:] if token.startswith(chr(0)) else token
+
+
 def pr_selector(argv, separate_value=MERGE_SEPARATE_VALUE):
     """The PR the command names, as gh itself would read it.
 
@@ -518,7 +597,7 @@ def pr_selector(argv, separate_value=MERGE_SEPARATE_VALUE):
             index += 1
             continue
         if not token.startswith("-"):
-            return token
+            return literal_value(token)
     return None
 
 
@@ -538,7 +617,7 @@ def retarget_target(argv):
         if token in COMMAND_SEPARATORS:
             return None
         if token in BASE_FLAGS and index < len(argv):
-            return argv[index]
+            return literal_value(argv[index])
         if token.startswith("--base="):
             return token.split("=", 1)[1]
         if token in EDIT_SEPARATE_VALUE:
@@ -562,7 +641,7 @@ def repo_flag(tokens, start):
         if token in COMMAND_SEPARATORS:
             break
         if token in {"-R", "--repo"} and index + 1 < len(tokens):
-            return ["--repo", tokens[index + 1]]
+            return ["--repo", literal_value(tokens[index + 1])]
         if token.startswith("--repo="):
             return ["--repo", token.split("=", 1)[1]]
         index += 1

package/all/copy-overwrite/scripts/lisa-hooks/block-managed-file-edits.sh

@@ -597,7 +597,13 @@ ENV_SPLIT_UNRESOLVED = 42
 BACKSLASH = chr(92)
 NEWLINE = chr(10)
 
-STATEMENT_SEPARATORS = {";", "|", "||", "&", "&&", "(", ")", "&|"}
+# `|&` pipes stdout and stderr into the next command, and the case terminators
+# end a statement as `;` does. Without them `printf x |& tee <managed>` stayed
+# one statement whose command word was `printf`, so the `tee` write target was
+# never examined.
+STATEMENT_SEPARATORS = {
+    ";", "|", "||", "&", "&&", "(", ")", "&|", "|&", ";;", ";&", ";;&",
+}
 # Ordinary output, noclobber override, and combined stdout/stderr output.
 # shlex separates fd prefixes (e.g. 10>>) from the operator automatically.
 REDIRECT_OUT = {">", ">>", ">|", "&>", "&>>", ">&"}

package/all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh

@@ -271,7 +271,41 @@ def disables_verification(token):
 # tokens, so the invocation's boundary is a token the scan can stop at.
 COMMAND_SEPARATORS = {
     ";", "|", "||", "&", "&&", "(", ")", "<", ">", ">>", "<<", "&|",
+    # `|&` pipes stdout AND stderr into the next command, so it ends a command
+    # exactly as `|` does. shlex emits it as one token, and before it was listed
+    # here `echo hi |& git commit --no-verify` read as a single `echo` command
+    # whose arguments happened to include git. The case terminators end a
+    # command the same way.
+    "|&", ";;", ";&", ";;&",
 }
+# shlex also GLUES adjacent punctuation into one token across distinct
+# operators: `(echo hi)|&git ...` arrives as `)|&`, which no set membership
+# test can recognise. An operator-only token is therefore re-split into the
+# operators it is made of, longest first. Redirections are kept whole and are
+# deliberately NOT separators, so `git commit 2>&1 -n` keeps its `-n` inside the
+# commit's argv scope.
+OPERATOR_ONLY = re.compile(r"^[();<>|&]+$")
+SHELL_OPERATOR = re.compile("|".join(
+    re.escape(operator) for operator in sorted(
+        COMMAND_SEPARATORS | {">|", "&>", "&>>", ">&", "<&", "<>", "<<<"},
+        key=lambda operator: (-len(operator), operator),
+    )
+))
+
+
+def split_operators(token):
+    """Split a glued operator-only token into the shell operators it holds.
+
+    Args:
+        token: One shlex token that was not read inside a quote or escape.
+
+    Returns:
+        The operators, longest first, or the token itself when it is not
+        made only of shell punctuation.
+    """
+    if OPERATOR_ONLY.match(token):
+        return SHELL_OPERATOR.findall(token)
+    return [token]
 
 SHELL_PROGRAMS = {"bash", "dash", "ksh", "sh", "zsh"}
 MAX_SHELL_NESTING = 8
@@ -425,14 +459,28 @@ def shell_tokens(text):
     Returns:
         The token list, with `;`, `|`, `&&`, `(` and friends standing alone.
     """
-    lexer = shlex.shlex(
-        line_boundaries_as_separators(text), posix=True, punctuation_chars=True
-    )
+    stream = OperatorStream(line_boundaries_as_separators(text))
+    lexer = shlex.shlex(stream, posix=True, punctuation_chars=True)
     lexer.whitespace_split = True
     # shlex treats `#` as a comment introducer by default and would silently
     # truncate the rest of the line; `shlex.split` disables it, and so must this.
     lexer.commenters = ""
-    return list(lexer)
+    stream.lexer = lexer
+    tokens = []
+    while True:
+        stream.literal_operator = False
+        token = lexer.get_token()
+        if token is None:
+            return tokens
+        # Quoted punctuation is an argument, never a boundary: it stays whole,
+        # and a quoted separator is marked so no scan stops at it (a path or
+        # branch can be named `|&`). Only real operator runs are split.
+        if stream.literal_operator:
+            tokens.append(
+                chr(0) + token if token in COMMAND_SEPARATORS else token
+            )
+        else:
+            tokens.extend(split_operators(token))
 
 
 def cluster_skips_verification(cluster):
@@ -1048,6 +1096,10 @@ def resolve_script(token):
     """
     if COMPUTED_VALUE.search(token):
         return (None, "a computed path the guard cannot resolve before the shell does")
+    # A quoted separator carries a NUL marker from shell_tokens; the path the
+    # shell passes is the argument without it.
+    if token.startswith(chr(0)):
+        token = token[1:]
     text = os.path.expanduser(token.strip().strip("'\""))
     # `bash -` and a bare `-` read the script from stdin; there is no file.
     if not text or text == "-":
@@ -1998,9 +2050,12 @@ def flat_tokens(text):
             # shlex otherwise makes quoted ";" indistinguishable from a real
             # command boundary. Keep literal destinations as data, so a setter
             # cannot masquerade as a one-operand configuration read.
-            if token in COMMAND_SEPARATORS and stream.literal_operator:
-                token = "\x00" + token
-            tokens.append(token)
+            if stream.literal_operator:
+                if token in COMMAND_SEPARATORS:
+                    token = "\x00" + token
+                tokens.append(token)
+            else:
+                tokens.extend(split_operators(token))
         return [
             token
             for index, token in enumerate(tokens)

package/all/copy-overwrite/scripts/lisa-rails-prepush.mjs

@@ -68,7 +68,10 @@ export const main = async (remoteArgs = process.argv.slice(2)) => {
     // Import/call inside this boundary instead of forwarding raw Node bootstrap
     // stderr. The scanner receives exactly the buffered Git stream.
     const { main: scan } = await import("./lisa-history-secrets.mjs");
-    if ((await scan(["pre-push"], process.cwd(), input)) !== 0) failed = true;
+    // Git's remote arguments bound a new ref's range by what that remote
+    // already holds; without them a new branch rescans the whole history.
+    if ((await scan(["pre-push", ...remoteArgs], process.cwd(), input)) !== 0)
+      failed = true;
   } catch {
     console.error(
       "Managed history scanner is unavailable or damaged. Run full Lisa apply and retry; raw bootstrap errors are withheld."