@codyswann/lisa 4.75.0 → 4.75.2

package/all/copy-overwrite/scripts/lib/npm-update-github.mjs

@@ -9,12 +9,33 @@ import { runProcess } from "./npm-update-process.mjs";
 import { gitObjectId } from "./npm-update-object.mjs";
 import { proposalFileNames } from "./npm-update-contract.mjs";
 import { executeCanonicalHelper } from "./npm-update-controller-factory.mjs";
+import { withProviderOperation } from "./npm-update-invariants.mjs";
 /** Explicit minimum gh identity and token; no caller/candidate executable override. */
 const HOST_OPTION = "--hostname";
 const GITHUB_HOST = "github.com";
 const TRANSPORT_PATH = "/usr/bin:/bin";
 const NO_HOME = "/nonexistent";
 
+/** Endpoint identifiers and query values never enter public diagnostics. */
+function providerPurpose(repository, endpoint) {
+  if (endpoint.startsWith("search/issues?")) return "issue-search";
+  if (endpoint === `repos/${repository}`) return "repository";
+  const route = endpoint.slice(`repos/${repository}/`.length).split("?")[0];
+  if (route === "git/ref/heads/main") return "main-reference";
+  if (route.startsWith("git/ref/heads/")) return "branch-reference";
+  if (/^actions\/runs\/\d+\/attempts\/\d+$/.test(route)) return "run-attempt";
+  if (/^collaborators\/[^/]+\/permission$/.test(route))
+    return "collaborator-permission";
+  if (/^issues\/comments\/\d+$/.test(route)) return "issue-comment";
+  if (/^issues\/\d+\/comments$/.test(route)) return "issue-comments";
+  if (/^issues\/\d+\/sub_issues$/.test(route)) return "issue-children";
+  if (/^issues\/\d+\/dependencies\/blocked_by$/.test(route))
+    return "issue-blockers";
+  if (/^issues(?:\/\d+)?$/.test(route)) return "issue";
+  if (/^pulls(?:\/\d+)?$/.test(route)) return "pulls";
+  return "unclassified";
+}
+
 export class GitHub {
   constructor(policy, token, execute = runProcess) {
     assertPinnedVerifier(policy);
@@ -42,17 +63,22 @@ export class GitHub {
       endpoint,
     ];
     if (body) args.push("--input", "-");
-    const result = await this.execute(this.policy.ghExecutable, args, {
-      env: {
-        PATH: TRANSPORT_PATH,
-        GH_TOKEN: this.token,
-        GH_HOST: GITHUB_HOST,
-        HOME: NO_HOME,
-        GIT_TERMINAL_PROMPT: "0",
-      },
-      input: body ? canonicalJson(body) : undefined,
-      timeout: 30_000,
-    });
+    const result = await withProviderOperation(
+      providerPurpose(this.policy.repository, endpoint),
+      method,
+      () =>
+        this.execute(this.policy.ghExecutable, args, {
+          env: {
+            PATH: TRANSPORT_PATH,
+            GH_TOKEN: this.token,
+            GH_HOST: GITHUB_HOST,
+            HOME: NO_HOME,
+            GIT_TERMINAL_PROMPT: "0",
+          },
+          input: body ? canonicalJson(body) : undefined,
+          timeout: 30_000,
+        })
+    );
     const bytes = result.stdout;
     required(bytes.length <= 3_145_728, "provider response exceeds bound");
     return bytes.length
@@ -77,18 +103,23 @@ export class GitHub {
       endpoint.startsWith(`repos/${this.policy.repository}/`),
       "recovery endpoint outside configured repository"
     );
-    const result = await this.execute(
-      this.policy.ghExecutable,
-      ["api", HOST_OPTION, GITHUB_HOST, "--include", endpoint],
-      {
-        env: {
-          PATH: TRANSPORT_PATH,
-          GH_TOKEN: this.token,
-          HOME: NO_HOME,
-        },
-        allowed: [0, 1],
-        timeout: 30_000,
-      }
+    const result = await withProviderOperation(
+      providerPurpose(this.policy.repository, endpoint),
+      "GET",
+      () =>
+        this.execute(
+          this.policy.ghExecutable,
+          ["api", HOST_OPTION, GITHUB_HOST, "--include", endpoint],
+          {
+            env: {
+              PATH: TRANSPORT_PATH,
+              GH_TOKEN: this.token,
+              HOME: NO_HOME,
+            },
+            allowed: [0, 1],
+            timeout: 30_000,
+          }
+        )
     );
     const text = result.stdout.toString();
     const split = text.includes("\r\n\r\n") ? "\r\n\r\n" : "\n\n";
@@ -129,23 +160,25 @@ export class GitHub {
     return repo;
   }
   async assignable(login) {
-    const result = await this.execute(
-      this.policy.ghExecutable,
-      [
-        "api",
-        HOST_OPTION,
-        GITHUB_HOST,
-        "--include",
-        `repos/${this.policy.repository}/assignees/${login}`,
-      ],
-      {
-        env: {
-          PATH: TRANSPORT_PATH,
-          GH_TOKEN: this.token,
-          HOME: NO_HOME,
-        },
-        timeout: 30_000,
-      }
+    const result = await withProviderOperation("unclassified", "GET", () =>
+      this.execute(
+        this.policy.ghExecutable,
+        [
+          "api",
+          HOST_OPTION,
+          GITHUB_HOST,
+          "--include",
+          `repos/${this.policy.repository}/assignees/${login}`,
+        ],
+        {
+          env: {
+            PATH: TRANSPORT_PATH,
+            GH_TOKEN: this.token,
+            HOME: NO_HOME,
+          },
+          timeout: 30_000,
+        }
+      )
     );
     required(
       /^HTTP\/\S+ 204\b/m.test(result.stdout.toString()),

package/all/copy-overwrite/scripts/lib/npm-update-helper.mjs

@@ -128,26 +128,22 @@ async function releaseAuthority(owner, config, bytes, members) {
         typeof registry.dist?.integrity === "string",
       "registry helper identity differs from approved source"
     );
-    const packed = JSON.parse(
-      (
-        await runNpm(
-          [
-            "pack",
-            `${PACKAGE}@${owner.metadata.version}`,
-            "--ignore-scripts",
-            "--json",
-            "--pack-destination",
-            root,
-          ],
-          { cwd: root, env, timeout: 120_000, maximum: 1_048_576 }
-        )
-      ).stdout
-    );
+    const packed = (
+      await runNpm(
+        [
+          "pack",
+          `${PACKAGE}@${owner.metadata.version}`,
+          "--ignore-scripts",
+          "--silent",
+          "--pack-destination",
+          root,
+        ],
+        { cwd: root, env, timeout: 120_000, maximum: 1_048_576 }
+      )
+    ).stdout;
     const filename = `codyswann-lisa-${owner.metadata.version}.tgz`;
     required(
-      Array.isArray(packed) &&
-        packed.length === 1 &&
-        packed[0].filename === filename,
+      packed.equals(Buffer.from(`${filename}\n`)),
       "registry archive selection differs"
     );
     const archive = join(root, filename);

package/all/copy-overwrite/scripts/lib/npm-update-invariants.mjs

@@ -30,6 +30,52 @@ const stages = new Set([
 ]);
 const diagnostics = new WeakMap();
 const capturedErrors = new WeakMap();
+const providerPurposes = new Set([
+  "repository",
+  "main-reference",
+  "branch-reference",
+  "run-attempt",
+  "collaborator-permission",
+  "issue-search",
+  "issue",
+  "issue-comments",
+  "issue-comment",
+  "issue-children",
+  "issue-blockers",
+  "pulls",
+  "unclassified",
+]);
+const providerMethods = new Set(["GET", "POST", "PATCH", "PUT", "DELETE"]);
+
+/** A single bounded child-reported status is a hint, never provider or retry authority. */
+function providerHttpHint(error, facts) {
+  const bytes = capturedErrors.get(error);
+  if (facts.native !== "exit" || facts.status !== 1 || !bytes) return null;
+  const text = bytes.toString("utf8");
+  if ([...text.matchAll(/\(HTTP /g)].length !== 1) return null;
+  const match =
+    /^gh: [\x20-\x7e]{1,220} \(HTTP (400|401|403|404|409|410|422|429|500|502|503|504)\)(?:\r?\n)?$/.exec(
+      text
+    );
+  return match ? Number(match[1]) : null;
+}
+
+/** Only an observed native failure receives fixed route labels; arbitrary exceptions remain opaque. */
+export async function withProviderOperation(purpose, method, operation) {
+  try {
+    return await operation();
+  } catch (error) {
+    const facts = diagnostics.get(error);
+    if (facts?.native)
+      diagnostics.set(error, {
+        ...facts,
+        provider: providerPurposes.has(purpose) ? purpose : "unclassified",
+        method: providerMethods.has(method) ? method : "unclassified",
+        providerHttp: providerHttpHint(error, facts),
+      });
+    throw error;
+  }
+}
 const provenancePhases = new Set([
   "local-proof",
   "configuration",
@@ -248,6 +294,14 @@ export function publicFailure(error) {
     }
   }
   if (facts?.provenance) parts.push(`provenance=${facts.provenance}`);
+  if (facts?.provider) {
+    parts.push(`provider=${facts.provider}`, `method=${facts.method}`);
+    if (facts.providerHttp !== null)
+      parts.push(
+        `http-reported=${facts.providerHttp}`,
+        "reports=child-reported-nonauthoritative"
+      );
+  }
   return `npm updater failed: required policy, authorization, installation, gate or exact publication evidence was unavailable (${parts.join(" ")})`;
 }
 

package/all/copy-overwrite/scripts/npm-updater-helper-graph.json

@@ -508,11 +508,12 @@
       "children": []
     },
     "lib/npm-update-github.mjs": {
-      "sha256": "2be34eca5ceb38cc535fac6ca0a655e14993231cd37b1a3e26ea09756042c488",
+      "sha256": "adef012960dc0c64dd68d687c2db9a66104780e0e68942f8ce27f11a0cf6262e",
       "staticImports": [
         "lib/github-attestation-verifier.mjs",
         "lib/npm-update-contract.mjs",
         "lib/npm-update-controller-factory.mjs",
+        "lib/npm-update-invariants.mjs",
         "lib/npm-update-object.mjs",
         "lib/npm-update-process.mjs",
         "lisa-automation-provenance.mjs"
@@ -527,7 +528,7 @@
       "children": []
     },
     "lib/npm-update-helper.mjs": {
-      "sha256": "41e5a37769ec3737829ed1948d0a1442792b25d120f0fb4f4b5e424a50f34705",
+      "sha256": "d705e0d8ae64285b539206f09784928a7fa678c2449252312a7079385e62ab90",
       "staticImports": [
         "lib/npm-update-classifier-cache.mjs",
         "lib/npm-update-contract.mjs",
@@ -655,7 +656,7 @@
       ]
     },
     "lib/npm-update-invariants.mjs": {
-      "sha256": "49fdc794312fe546014a5a4c5c4804da758832a912721733fecec8497aa548aa",
+      "sha256": "4d60f2528e013b65837e8d60eef8728a34b2005fcabaec20d59fd5f759890810",
       "staticImports": [],
       "dynamicImports": [],
       "children": []

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA4hEjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA+7DjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAiiEjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAo8DjC,CAAC"}

package/dist/core/lisa-owned-hash-ledger.js

@@ -688,6 +688,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "2be34eca5ceb38cc535fac6ca0a655e14993231cd37b1a3e26ea09756042c488",
         "5026c943e0ce87318a713806c1d609022d9818cd51a04b444b95285aa5aeadf8",
         "543f6baa36e10ae5022ecc55748c439803b2e549b2c278090b213a9db7db9ec5",
+        "adef012960dc0c64dd68d687c2db9a66104780e0e68942f8ce27f11a0cf6262e",
         "c1293afee9cc78d5688155a7e4d5b4f23541c191d62646da4e5443c54c56203b",
     ]),
     "scripts/lib/npm-update-helper-graph.mjs": Object.freeze([
@@ -710,6 +711,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
     "scripts/lib/npm-update-helper.mjs": Object.freeze([
         "41e5a37769ec3737829ed1948d0a1442792b25d120f0fb4f4b5e424a50f34705",
         "d6ad6d094f56a1d08fabbae7e2df90779f7912d3380a4c9e792b305863901dda",
+        "d705e0d8ae64285b539206f09784928a7fa678c2449252312a7079385e62ab90",
         "f4012383184237aa0a7ca21847864fdcc2241f94fd3d2cd6d82a6345763e5824",
     ]),
     "scripts/lib/npm-update-hook-installation.mjs": Object.freeze([
@@ -752,6 +754,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "136cb22396d33252494c4df1e35d13ff58c58a0ca34fbe5c68954b077cb3f30b",
         "447af561aef70ca93dc69a59f7989d123a79078ecad60e26897e3d2eaa48ea18",
         "49fdc794312fe546014a5a4c5c4804da758832a912721733fecec8497aa548aa",
+        "4d60f2528e013b65837e8d60eef8728a34b2005fcabaec20d59fd5f759890810",
         "866525d6b23523dc5d45cd1ed7794e31f84be5cc636288cc05d0e54d0cee63a6",
         "8de07e0513667914a4bf3612adacaa6fff43fd56df261bd20e0f1b1240140076",
         "e7a093ceeaca34b6e0cf2ea2eccd3b5e1882e295ec2baeeaec9da0373e669687",
@@ -1958,6 +1961,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
     "scripts/npm-updater-helper-graph.json": Object.freeze([
         "07349149a13f75cf3d517202317aaa1dbe6b06b8c46a45a1512097dca85157da",
         "09352aa145bc81c3c5dab282c61d084cbbe5af6242d7d12303ad764fbad53de2",
+        "09ef191f06018f4fe7ac580b94e096d6370ab5a3e816e00401597a70470ebb2b",
         "0b8d6e6cd22d8a2edef3437c772a7ddf7afc7e7c61e73476323da11d0972a888",
         "0d82401079f442dd1a617a2a85b910be321ba0badbef2120d9ad4b9cff3767bc",
         "15eceda920bf731bd12154af634b69d2f684d8672baff4d0f3e66f18b7a9806f",
@@ -2006,6 +2010,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "c11328d3d4fd6d0f82ad51afc21f710877bd8dd2643c9d1a7d0fd2fed60358eb",
         "c17d09e07c614df6843ba3bb6ae0c80874108eff22a68ef324db5f50110a27c8",
         "c82274d45042e09fecc36b0c60a50a2dfa9850ce53a4cc4ec21f08e9a58167bf",
+        "ca7ad7b71210cab32112fca2bc5f74c0dd2dd8495c421027f90387ac2de11d39",
         "cc470166e767e41237dc9f6e990078ff303766dc091edac2ec9686d81e6d7299",
         "d0ef0fa86b289ad5a2cda82572e85ec578c31b37140eff1160344a4e71eab98c",
         "d0f385cf050a02d9fe57cde474cf0ed9a357c2c2767cc94042c54a763cbeddc8",
@@ -2758,6 +2763,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "2be34eca5ceb38cc535fac6ca0a655e14993231cd37b1a3e26ea09756042c488",
         "5026c943e0ce87318a713806c1d609022d9818cd51a04b444b95285aa5aeadf8",
         "543f6baa36e10ae5022ecc55748c439803b2e549b2c278090b213a9db7db9ec5",
+        "adef012960dc0c64dd68d687c2db9a66104780e0e68942f8ce27f11a0cf6262e",
         "c1293afee9cc78d5688155a7e4d5b4f23541c191d62646da4e5443c54c56203b",
     ]),
     "scripts/lib/npm-update-helper-graph.mjs": Object.freeze([
@@ -2780,6 +2786,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
     "scripts/lib/npm-update-helper.mjs": Object.freeze([
         "41e5a37769ec3737829ed1948d0a1442792b25d120f0fb4f4b5e424a50f34705",
         "d6ad6d094f56a1d08fabbae7e2df90779f7912d3380a4c9e792b305863901dda",
+        "d705e0d8ae64285b539206f09784928a7fa678c2449252312a7079385e62ab90",
         "f4012383184237aa0a7ca21847864fdcc2241f94fd3d2cd6d82a6345763e5824",
     ]),
     "scripts/lib/npm-update-hook-installation.mjs": Object.freeze([
@@ -2822,6 +2829,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "136cb22396d33252494c4df1e35d13ff58c58a0ca34fbe5c68954b077cb3f30b",
         "447af561aef70ca93dc69a59f7989d123a79078ecad60e26897e3d2eaa48ea18",
         "49fdc794312fe546014a5a4c5c4804da758832a912721733fecec8497aa548aa",
+        "4d60f2528e013b65837e8d60eef8728a34b2005fcabaec20d59fd5f759890810",
         "866525d6b23523dc5d45cd1ed7794e31f84be5cc636288cc05d0e54d0cee63a6",
         "8de07e0513667914a4bf3612adacaa6fff43fd56df261bd20e0f1b1240140076",
         "e7a093ceeaca34b6e0cf2ea2eccd3b5e1882e295ec2baeeaec9da0373e669687",
@@ -3958,6 +3966,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
     "scripts/npm-updater-helper-graph.json": Object.freeze([
         "07349149a13f75cf3d517202317aaa1dbe6b06b8c46a45a1512097dca85157da",
         "09352aa145bc81c3c5dab282c61d084cbbe5af6242d7d12303ad764fbad53de2",
+        "09ef191f06018f4fe7ac580b94e096d6370ab5a3e816e00401597a70470ebb2b",
         "0b8d6e6cd22d8a2edef3437c772a7ddf7afc7e7c61e73476323da11d0972a888",
         "0d82401079f442dd1a617a2a85b910be321ba0badbef2120d9ad4b9cff3767bc",
         "15eceda920bf731bd12154af634b69d2f684d8672baff4d0f3e66f18b7a9806f",
@@ -4006,6 +4015,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "c11328d3d4fd6d0f82ad51afc21f710877bd8dd2643c9d1a7d0fd2fed60358eb",
         "c17d09e07c614df6843ba3bb6ae0c80874108eff22a68ef324db5f50110a27c8",
         "c82274d45042e09fecc36b0c60a50a2dfa9850ce53a4cc4ec21f08e9a58167bf",
+        "ca7ad7b71210cab32112fca2bc5f74c0dd2dd8495c421027f90387ac2de11d39",
         "cc470166e767e41237dc9f6e990078ff303766dc091edac2ec9686d81e6d7299",
         "d0ef0fa86b289ad5a2cda82572e85ec578c31b37140eff1160344a4e71eab98c",
         "d0f385cf050a02d9fe57cde474cf0ed9a357c2c2767cc94042c54a763cbeddc8",