@codyswann/lisa 4.73.1 → 4.73.3

package/README.md

@@ -333,6 +333,26 @@ agent configuration changes. This retirement
 boundary belongs to the Codex project overlay. The other supported agents do
 not delete this shell-command layout during apply.
 
+Fallback diagnostics compare each selected host guard entry file with the
+installed package's template, separately from its historical apply receipt.
+Matching bytes need no apply repair; differing bytes and unknown evidence are
+reported separately. Installed plugin channel versions remain independent
+evidence and do not prove those hooks are live. The optional Node helper ships
+beside the fallback; without it, enforcement still runs and freshness is unknown.
+Diagnostics are offline and lazy: at most eight guard/template pairs (1 MiB per
+file), four 64 KiB manifests/receipts and one 4 MiB plugin registry, with one
+additional byte per read to detect overflow. After the session notice, permitted
+calls invoke no freshness helper. Later refusals re-evaluate their own evidence.
+
+| Agent | Fallback diagnostic surface |
+| --- | --- |
+| Claude Code | Repository PreToolUse fallback; independent plugin guards remain registered. |
+| Codex | Tagged project hook dispatches the same delivered fallback after project trust. |
+| Cursor | Native individual guard registrations; the common host fallback is delivered, but its aggregate diagnostic is not registered natively. |
+| OpenCode | Native TypeScript guard adapters; the common host fallback is delivered, but its aggregate diagnostic is not represented by those adapters. |
+| Antigravity | Native adapted guard commands; the common host fallback is delivered, but its aggregate diagnostic is not registered natively. |
+| Copilot | Native individual guard registrations; the common host fallback is delivered, but its aggregate diagnostic is not registered natively. |
+
 Remote coding environments use one vendor-neutral AWS bootstrap rather than
 repository-specific or agent-specific IAM users. Run `/lisa:setup-remote-aws`
 to install the common setup script and native Cursor/Copilot adapters; Claude,

package/all/copy-overwrite/scripts/lib/history-secret-git.mjs

@@ -44,12 +44,15 @@ export const gitEnvironment = () => {
   };
 };
 
+/** Replacement refs must never redirect which objects a proof reads. */
+const NO_REPLACE_OBJECTS = "--no-replace-objects";
+
 /** Git errors can contain arbitrary payloads; only authored guidance leaves here. */
-export const gitRead = (args, cwd) => {
+export const gitRead = (args, cwd, input) => {
   const result = spawnSync(
     "git",
     [
-      "--no-replace-objects",
+      NO_REPLACE_OBJECTS,
       "-c",
       "diff.external=",
       "-c",
@@ -60,6 +63,7 @@ export const gitRead = (args, cwd) => {
       cwd,
       env: gitEnvironment(),
       encoding: "utf8",
+      input,
       timeout: 120000,
       maxBuffer: 64 * 1024 * 1024,
     }
@@ -151,8 +155,143 @@ export const eventPairs = (event, name, width) => {
   );
 };
 
+/**
+ * Git configuration exactly as the push itself sees it.
+ *
+ * gitEnvironment pins configuration so history reads cannot be steered, which
+ * is right for walking objects and wrong for naming a destination: the push
+ * resolved its URL, `pushurl`, `pushInsteadOf` and credentials through user,
+ * system and environment configuration, and a destination resolved under any
+ * other configuration may be a different repository.
+ */
+const remoteEnvironment = () => {
+  const environment = gitEnvironment();
+  for (const key of Object.keys(environment))
+    if (key.startsWith("GIT_CONFIG")) delete environment[key];
+  for (const [key, value] of Object.entries(process.env))
+    if (key.startsWith("GIT_CONFIG") && value !== undefined)
+      environment[key] = value;
+  // Never wait on a person: no terminal prompt and no askpass program, so a
+  // destination that needs an unavailable credential fails at once.
+  return { ...environment, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "" };
+};
+
+/**
+ * Run one destination-resolution read under the push's own configuration.
+ * @param {string[]} args Git arguments.
+ * @param {string} cwd Repository directory.
+ * @returns {string | null} Trimmed stdout, or null when Git refused or failed.
+ */
+const remoteRead = (args, cwd) => {
+  const result = spawnSync("git", [NO_REPLACE_OBJECTS, ...args], {
+    cwd,
+    env: remoteEnvironment(),
+    encoding: "utf8",
+    timeout: 60000,
+    maxBuffer: 64 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "ignore"],
+  });
+  // probe-direction: fail-closed — every caller treats null as "the
+  // destination is unproved", which subtracts nothing from the scan.
+  if (result.error || result.signal || result.status !== 0) return null;
+  return result.stdout.trim();
+};
+
+/**
+ * The repository a push is actually going to, from Git's pre-push arguments.
+ *
+ * Git calls the hook with the remote's name (or the URL, when the push named
+ * no remote) and the URL it pushes to, already rewritten by `pushInsteadOf`.
+ * That URL is the destination, so it wins when present. A wrapper that
+ * forwards only a remote NAME gets that remote's push URL, resolved under the
+ * push's own configuration; a remote with several push URLs, or a bare URL
+ * with no `$2`, cannot be pinned to one destination and returns null. A value
+ * that looks like an option is never used.
+ * @param {string[]} remoteArgs Git's pre-push `$1` and `$2`, as forwarded.
+ * @param {string} cwd Repository directory.
+ * @returns {string | null} The destination, or null when it cannot be proved.
+ */
+export const pushDestination = (remoteArgs, cwd) => {
+  const [remote, url] = remoteArgs ?? [];
+  const usable = value =>
+    typeof value === "string" && value !== "" && !value.startsWith("-");
+  if (usable(url)) return url;
+  if (!usable(remote)) return null;
+  const names = (remoteRead(["remote"], cwd) ?? "").split("\n");
+  if (!names.includes(remote)) return null;
+  const urls = (
+    remoteRead(["remote", "get-url", "--push", "--all", "--", remote], cwd) ??
+    ""
+  )
+    .split("\n")
+    .filter(Boolean);
+  return urls.length === 1 ? urls[0] : null;
+};
+
+/**
+ * Commit IDs the push destination advertises right now that exist locally.
+ *
+ * Asked of the destination itself (`git ls-remote`), not read from local
+ * tracking refs: a tracking ref can outlive a branch deleted or reset on the
+ * remote, and with a separate pushurl it describes a different repository, so
+ * either would exclude commits the destination lacks. An advertised ID this
+ * repository does not have cannot bound a local walk and is dropped, which
+ * only ever widens the scan.
+ * @param {string | null} destination The push destination from pushDestination.
+ * @param {string} cwd Repository directory.
+ * @returns {string[]} IDs to exclude; empty when nothing could be proved.
+ */
+export const advertisedTips = (destination, cwd) => {
+  if (destination === null) return [];
+  // An `insteadOf` rule can rewrite even a URL Git already rewrote for the
+  // push, and then the probe would describe another repository. Trust the
+  // advertisement only when ls-remote would contact the destination itself.
+  // probe-direction: fail-closed — a URL that cannot be confirmed subtracts
+  // nothing.
+  if (
+    remoteRead(["ls-remote", "--get-url", "--", destination], cwd) !==
+    destination
+  )
+    return [];
+  const listed = spawnSync(
+    "git",
+    [NO_REPLACE_OBJECTS, "ls-remote", "--", destination],
+    {
+      cwd,
+      env: remoteEnvironment(),
+      encoding: "utf8",
+      timeout: 60000,
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "ignore"],
+    }
+  );
+  // probe-direction: fail-closed — a destination that cannot be asked
+  // advertises nothing, so nothing is subtracted and the complete history is
+  // scanned.
+  if (listed.error || listed.signal || listed.status !== 0) return [];
+  const advertised = [
+    ...new Set(
+      listed.stdout
+        .split("\n")
+        .map(line => line.split("\t")[0])
+        .filter(id => /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u.test(id))
+    ),
+  ];
+  if (advertised.length === 0) return [];
+  const present = gitRead(
+    ["cat-file", "--batch-check=%(objectname) %(objecttype)"],
+    cwd,
+    advertised.map(id => `${id}\n`).join("")
+  );
+  return present
+    .split("\n")
+    .map(line => line.split(" "))
+    .filter(([, type]) => type === "commit" || type === "tag")
+    .map(([id]) => id);
+};
+
 /** Pairwise subtraction prevents one ref's old tip from hiding another update. */
-export const introducedCommits = (pairs, cwd, width) => {
+export const introducedCommits = (pairs, cwd, width, remoteArgs = []) => {
   const oid = new RegExp(`^[a-f0-9]{${width}}$`, "u");
   for (const pair of pairs) {
     if (!oid.test(pair.before ?? "") || !oid.test(pair.after ?? ""))
@@ -175,6 +314,16 @@ export const introducedCommits = (pairs, cwd, width) => {
       "Legacy Git grafts prevent complete history proof. Use an unmodified complete repository checkout."
     );
   const commits = new Set();
+  // A new remote ref (zero `before`) has no old tip to subtract, and scanning
+  // everything reachable from it counts the remote's own published history as
+  // introduced: every new branch of an old repository then re-litigates its
+  // root commit. What a push introduces is what the destination does not
+  // already hold, so a new ref subtracts what the push destination advertises.
+  // Without a destination, or one that cannot be asked, nothing is subtracted
+  // and the complete reachable history is scanned as before.
+  const published = updates.some(pair => /^0+$/u.test(pair.before))
+    ? advertisedTips(pushDestination(remoteArgs, cwd), cwd)
+    : [];
   for (const { before, after } of updates) {
     const next = gitRead(["rev-parse", "--verify", `${after}^{commit}`], cwd);
     const previous = /^0+$/u.test(before)
@@ -190,9 +339,13 @@ export const introducedCommits = (pairs, cwd, width) => {
           "Required Git trees or blobs are missing. Fetch complete objects, repair the checkout and retry."
         );
     }
+    // Exclusions go through stdin: a remote can hold more refs than one
+    // command line carries.
+    const exclusions = previous ? [previous] : published;
     const list = gitRead(
-      ["rev-list", next, ...(previous ? [`^${previous}`] : [])],
-      cwd
+      ["rev-list", "--stdin", next],
+      cwd,
+      exclusions.map(oid => `^${oid}\n`).join("")
     );
     for (const commit of list.split("\n").filter(Boolean)) commits.add(commit);
   }

package/all/copy-overwrite/scripts/lib/npm-update-contract.mjs

@@ -109,7 +109,31 @@ export function validateLock(lock, manifest, updates) {
         !item.link,
       "unsupported lock node"
     );
-    const url = new URL(item.resolved);
+    // A bundled dependency ships inside its parent's tarball, so npm records
+    // no source or integrity of its own: the parent's registry integrity is
+    // what covers its bytes. Accept it only nested under a parent this loop
+    // also validates, and never when it claims a source of its own.
+    if (item.inBundle === true) {
+      required(
+        item.resolved === undefined && item.integrity === undefined,
+        "bundled lock node declares its own source"
+      );
+      const boundary = name.lastIndexOf("/node_modules/");
+      const parent = boundary < 0 ? "" : name.slice(0, boundary);
+      required(
+        parent.startsWith("node_modules/") &&
+          Object.hasOwn(lock.packages, parent),
+        "bundled lock node has no registry parent"
+      );
+      continue;
+    }
+    required(typeof item.resolved === "string", "registry source missing");
+    let url;
+    try {
+      url = new URL(item.resolved);
+    } catch {
+      required(false, "registry source unparseable");
+    }
     required(
       url.protocol === "https:" &&
         url.hostname === "registry.npmjs.org" &&