@codyswann/lisa 4.84.5 → 4.84.6

package/scripts/lib/host-name-review-cases.mjs

@@ -0,0 +1,354 @@
+/** Actual-wrapper regressions for independently reproduced target/context findings. */
+export function hostNameReviewCases({
+  hostCwd,
+  lisaCwd,
+  unknownCwd,
+  body,
+  cdStart,
+  cdSearch,
+  cdHost,
+  fixtureName,
+  lisa,
+  host,
+}) {
+  const continuation = "\\\n";
+  const cases = [
+    [
+      "continuation before the noun retains protected inspection",
+      hostCwd,
+      `gh ${continuation} issue create --repo ${lisa} --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "continuation between noun and verb retains protected inspection",
+      hostCwd,
+      `gh issue ${continuation} create --repo ${lisa} --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "continuation before body text retains protected inspection",
+      hostCwd,
+      `gh issue create --repo ${lisa} --body ${continuation} ${fixtureName}`,
+      2,
+    ],
+    [
+      "continuation before a host API endpoint preserves exemption",
+      lisaCwd,
+      `gh api ${continuation} repos/${host}/issues -f body=${fixtureName}`,
+      0,
+    ],
+    [
+      "continuation before a protected API endpoint retains inspection",
+      hostCwd,
+      `gh api ${continuation} repos/${lisa}/issues -f body=${fixtureName}`,
+      2,
+    ],
+    [
+      "continuation before explicit host repository preserves exemption",
+      lisaCwd,
+      `gh issue create --repo ${continuation} ${host} --body ${fixtureName}`,
+      0,
+    ],
+    [
+      "continuation before explicit protected repository retains inspection",
+      hostCwd,
+      `gh issue create --repo ${continuation} ${lisa} --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "continuation between noun and verb keeps unknown target guarded",
+      unknownCwd,
+      `gh issue ${continuation} create --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "continuation between noun and verb keeps known host allowed",
+      hostCwd,
+      `gh issue ${continuation} create --repo ${host} --body ${fixtureName}`,
+      0,
+    ],
+    [
+      "continuation before an API field value retains protected inspection",
+      hostCwd,
+      `gh api repos/${lisa}/issues -f ${continuation} body=${fixtureName}`,
+      2,
+    ],
+    [
+      "continuation within an existing verb preserves the word",
+      hostCwd,
+      `gh issue cre${continuation}ate --repo ${lisa} --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "double quoted continuation preserves existing body text",
+      hostCwd,
+      `gh issue create --repo ${lisa} --body "${fixtureName.slice(0, 8)}${continuation}${fixtureName.slice(8)}"`,
+      2,
+    ],
+    [
+      "a real quoted empty verb stays distinct from continuation whitespace",
+      hostCwd,
+      `gh issue "" create --repo ${lisa} --body ${fixtureName}`,
+      0,
+    ],
+    [
+      "continuation after a quoted empty body preserves the empty value",
+      hostCwd,
+      `gh issue create --repo ${lisa} --body ""${continuation} ${fixtureName}`,
+      0,
+    ],
+    [
+      "continuation preserves nonliteral argument uncertainty",
+      hostCwd,
+      `gh issue create --repo ${host} --title "$TITLE${continuation}" --body ${fixtureName}`,
+      2,
+      { TITLE: "Unresolved title" },
+    ],
+    [
+      "CDPATH inherited lookup cannot certify a host target",
+      cdStart,
+      `cd target && gh issue create --body ${fixtureName}`,
+      2,
+      { CDPATH: cdSearch },
+    ],
+    [
+      "CDPATH export lookup cannot certify a host target",
+      cdStart,
+      `export CDPATH='${cdSearch}'; cd target && gh issue create --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "CDPATH command assignment cannot certify a host target",
+      cdStart,
+      `CDPATH='${cdSearch}' cd target && gh issue create --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "CDPATH standalone assignment cannot certify a host target",
+      cdStart,
+      `CDPATH='${cdSearch}'; cd target && gh issue create --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "CDPATH relative body must not be read from the wrong directory",
+      cdStart,
+      `cd target && gh issue create --repo ${lisa} --body-file body.md`,
+      2,
+      { CDPATH: cdSearch },
+      "BLOCKED: the working directory",
+    ],
+    [
+      "uncertain CDPATH export cannot certify relative body location",
+      cdStart,
+      `export CDPATH="$SEARCH_PATH"; cd target && gh issue create --repo ${lisa} --body-file body.md`,
+      2,
+      { SEARCH_PATH: cdSearch },
+      "BLOCKED: the working directory",
+    ],
+    [
+      "dot relative cd bypasses CDPATH lookup",
+      cdStart,
+      `cd ./target && gh issue create --body ${fixtureName}`,
+      0,
+      { CDPATH: cdSearch },
+    ],
+    [
+      "parent relative cd bypasses CDPATH lookup",
+      cdHost,
+      `cd ../target && gh issue create --body ${fixtureName}`,
+      0,
+      { CDPATH: cdSearch },
+    ],
+    [
+      "absolute cd bypasses CDPATH lookup",
+      cdStart,
+      `cd '${cdHost}' && gh issue create --body ${fixtureName}`,
+      0,
+      { CDPATH: cdSearch },
+    ],
+    [
+      "empty CDPATH preserves literal relative cd",
+      cdStart,
+      `cd target && gh issue create --body ${fixtureName}`,
+      0,
+    ],
+    [
+      "unquoted argv expansion cannot add an unseen winning repo",
+      hostCwd,
+      `gh issue comment 1 --repo ${host} $ROUTING --body ${fixtureName}`,
+      2,
+      { ROUTING: `--repo ${lisa}` },
+    ],
+    [
+      "nonliteral consumed option value cannot earn target exemption",
+      hostCwd,
+      `gh issue create --repo ${host} --title "$TITLE" --body ${fixtureName}`,
+      2,
+      { TITLE: "Unresolved title" },
+    ],
+    [
+      "literal numeric selector keeps explicit host target",
+      lisaCwd,
+      `gh issue comment 1 --repo ${host} --body ${fixtureName}`,
+      0,
+    ],
+    [
+      "standalone unexported repository assignment cannot certify a target",
+      lisaCwd,
+      `GH_REPO=${host}; gh issue create --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "API input alone defaults to inspected POST",
+      hostCwd,
+      `gh api repos/${lisa}/issues --input '${body}'`,
+      2,
+    ],
+    [
+      "API input explicit POST remains inspected",
+      hostCwd,
+      `gh api repos/${lisa}/issues --method POST --input '${body}'`,
+      2,
+    ],
+    [
+      "API input explicit GET remains read only",
+      hostCwd,
+      `gh api repos/${lisa}/issues --method GET --input '${body}'`,
+      0,
+    ],
+    [
+      "API input to verified host remains allowed",
+      lisaCwd,
+      `gh api repos/${host}/issues --input '${body}'`,
+      0,
+    ],
+    [
+      "mixed host and Lisa issue URLs retain protection",
+      hostCwd,
+      `gh issue edit https://github.com/${host}/issues/1 https://github.com/${lisa}/issues/2 --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "host URL and numeric selectors select the common host",
+      hostCwd,
+      `gh issue edit https://github.com/${host}/issues/1 2 --body ${fixtureName}`,
+      0,
+    ],
+    [
+      "same-host URL selectors select the common host",
+      hostCwd,
+      `gh issue edit https://github.com/${host}/issues/1 https://github.com/${host}/issues/2 --body ${fixtureName}`,
+      0,
+    ],
+    [
+      "host URL batch outranks conflicting Lisa repo flag",
+      lisaCwd,
+      `gh issue edit https://github.com/${host}/issues/1 https://github.com/${host}/issues/2 --repo ${lisa} --body ${fixtureName}`,
+      0,
+    ],
+    [
+      "host URL with numeric selector outranks Lisa repo flag",
+      lisaCwd,
+      `gh issue edit https://github.com/${host}/issues/1 2 --repo ${lisa} --body ${fixtureName}`,
+      0,
+    ],
+    [
+      "numeric selector before host URL inherits the URL repository",
+      lisaCwd,
+      `gh issue edit 2 https://github.com/${host}/issues/1 --repo ${lisa} --body ${fixtureName}`,
+      0,
+    ],
+    [
+      "protected URL batch outranks conflicting host repo flag",
+      hostCwd,
+      `gh issue edit https://github.com/${lisa}/issues/1 https://github.com/${lisa}/issues/2 --repo ${host} --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "protected URL with numeric selector outranks host repo flag",
+      hostCwd,
+      `gh issue edit https://github.com/${lisa}/issues/1 '#2' --repo ${host} --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "numeric-only issue batch retains explicit host fallback",
+      lisaCwd,
+      `gh issue edit 1 2 --repo ${host} --body ${fixtureName}`,
+      0,
+    ],
+    [
+      "numeric-only issue batch retains protected fallback",
+      hostCwd,
+      `gh issue edit 1 2 --repo ${lisa} --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "same owner and repository on different URL hosts stay unknown",
+      hostCwd,
+      `gh issue edit https://github.com/${host}/issues/1 https://other.example/${host}/issues/2 --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "issue URL repository suffixes remain distinct batch identities",
+      hostCwd,
+      `gh issue edit https://github.com/${host}/issues/1 https://github.com/${host}.git/issues/2 --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "invalid selector cannot inherit a host URL repository",
+      hostCwd,
+      `gh issue edit https://github.com/${host}/issues/1 not-an-issue --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "nonliteral batch selector cannot inherit a host URL repository",
+      hostCwd,
+      `gh issue edit https://github.com/${host}/issues/1 $ISSUE_NUMBERS --body ${fixtureName}`,
+      2,
+      { ISSUE_NUMBERS: "2" },
+    ],
+    [
+      "issue comment retains single-selector boundary",
+      hostCwd,
+      `gh issue comment https://github.com/${host}/issues/1 https://github.com/${host}/issues/2 --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "PR edit retains single-selector boundary",
+      hostCwd,
+      `gh pr edit https://github.com/${host}/pull/1 https://github.com/${host}/pull/2 --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "unanimous host URL batch compares repository case insensitively",
+      lisaCwd,
+      `gh issue edit https://github.com/${host}/issues/1 https://github.com/${host.toUpperCase()}/issues/2 --repo ${lisa} --body ${fixtureName}`,
+      0,
+    ],
+  ];
+  for (const noun of ["issue", "pr"])
+    for (const verb of ["comment", "edit"]) {
+      const kind = noun === "issue" ? "issues" : "pull";
+      cases.push(
+        [
+          `${noun} ${verb} positional Lisa URL outranks host origin`,
+          hostCwd,
+          `gh ${noun} ${verb} https://github.com/${lisa}/${kind}/1 --body ${fixtureName}`,
+          2,
+        ],
+        [
+          `${noun} ${verb} positional Lisa URL outranks host repo flag`,
+          hostCwd,
+          `gh ${noun} ${verb} https://github.com/${lisa}/${kind}/1 --repo ${host} --body ${fixtureName}`,
+          2,
+        ],
+        [
+          `${noun} ${verb} positional host URL outranks Lisa repo flag`,
+          lisaCwd,
+          `gh ${noun} ${verb} https://github.com/${host}/${kind}/1 --repo ${lisa} --body ${fixtureName}`,
+          0,
+        ]
+      );
+    }
+  return cases;
+}

package/scripts/lib/host-name-target-cases.mjs

@@ -0,0 +1,298 @@
+/** Named real-wrapper cases; only synthetic identities are used. */
+export function hostNameTargetCases({
+  hostCwd,
+  lisaCwd,
+  unknownCwd,
+  body,
+  selectedLisa,
+  selectedHost,
+  relative,
+  quotedHost,
+  ambiguous,
+  fixtureName,
+  lisa,
+  host,
+}) {
+  return [
+    [
+      "host explicit --repo allowed",
+      hostCwd,
+      `gh pr create --repo ${host} --title t --body-file ${body}`,
+      0,
+    ],
+    [
+      "host explicit -R allowed",
+      hostCwd,
+      `gh issue create -R ${host} --title t --body-file ${body}`,
+      0,
+    ],
+    [
+      "host explicit --repo= allowed",
+      hostCwd,
+      `gh issue create --repo=${host} --title t --body-file ${body}`,
+      0,
+    ],
+    [
+      "host API endpoint allowed",
+      hostCwd,
+      `gh api repos/${host}/issues -X POST -f body=${fixtureName}`,
+      0,
+    ],
+    [
+      "host origin allowed",
+      hostCwd,
+      `gh issue create --title t --body-file ${body}`,
+      0,
+    ],
+    [
+      "protected explicit target blocked from host checkout",
+      hostCwd,
+      `gh issue create --repo ${lisa} --title t --body-file ${body}`,
+      2,
+    ],
+    [
+      "protected origin blocked",
+      lisaCwd,
+      `gh issue create --title t --body-file ${body}`,
+      2,
+    ],
+    [
+      "unknown target remains blocked",
+      unknownCwd,
+      `gh issue create --title t --body-file ${body}`,
+      2,
+    ],
+    [
+      "protected clean body allowed",
+      lisaCwd,
+      `gh pr create --repo ${lisa} --title t --body 'A clean report.'`,
+      0,
+    ],
+    [
+      "protected read-only request allowed",
+      lisaCwd,
+      `gh api repos/${lisa}/issues -X GET -F body=@${body}`,
+      0,
+    ],
+    [
+      "API explicit POST field-file control blocked",
+      hostCwd,
+      `gh api repos/${lisa}/issues -X POST -F body=@${body}`,
+      2,
+    ],
+    [
+      "review's See-repos body example remains blocked control",
+      lisaCwd,
+      `gh pr create --title t --body 'See repos/${host}/issues: ${fixtureName}'`,
+      2,
+    ],
+    [
+      "API-path-leading body cannot exempt protected write",
+      lisaCwd,
+      `gh pr create --title t --body 'repos/${host}/issues: ${fixtureName}'`,
+      2,
+    ],
+    [
+      "API unresolved placeholders retain protection",
+      lisaCwd,
+      `gh api 'repos/{owner}/{repo}/issues' -f body=${fixtureName}`,
+      2,
+    ],
+    [
+      "API -F default POST is inspected",
+      hostCwd,
+      `gh api repos/${lisa}/issues -F body=@${body}`,
+      2,
+    ],
+    [
+      "effective cd into protected checkout retains protection",
+      hostCwd,
+      `cd '${lisaCwd}' && gh issue create --title t --body '${fixtureName}'`,
+      2,
+    ],
+    [
+      "effective cd into host checkout permits host naming itself",
+      lisaCwd,
+      `cd '${hostCwd}' && gh issue create --title t --body '${fixtureName}'`,
+      0,
+    ],
+    [
+      "relative body file follows effective command cwd",
+      lisaCwd,
+      `cd '${relative}' && gh pr create --repo ${lisa} --title t --body-file body.md`,
+      2,
+    ],
+    [
+      "GH_REPO protected override outranks host origin",
+      hostCwd,
+      `gh issue create --title t --body-file ${body}`,
+      2,
+      { GH_REPO: lisa },
+    ],
+    [
+      "GH_REPO host override outranks protected origin",
+      lisaCwd,
+      `gh issue create --title t --body-file ${body}`,
+      0,
+      { GH_REPO: host },
+    ],
+    [
+      "selected protected default outranks host origin",
+      selectedLisa,
+      `gh issue create --title t --body-file ${body}`,
+      2,
+    ],
+    [
+      "selected host default outranks protected origin",
+      selectedHost,
+      `gh issue create --title t --body-file ${body}`,
+      0,
+    ],
+
+    [
+      "literal GH_REPO assignment protects Lisa",
+      hostCwd,
+      `GH_REPO=${lisa} gh issue create --title t --body-file ${body}`,
+      2,
+    ],
+    [
+      "literal assignment overrides inherited GH_REPO",
+      lisaCwd,
+      `GH_REPO=${host} gh issue create --title t --body-file ${body}`,
+      0,
+      { GH_REPO: lisa },
+    ],
+    [
+      "env GH_REPO assignment protects Lisa",
+      hostCwd,
+      `env GH_REPO=${lisa} gh issue create --title t --body-file ${body}`,
+      2,
+    ],
+    [
+      "env GH_REPO assignment permits host",
+      lisaCwd,
+      `env GH_REPO=${host} gh issue create --title t --body-file ${body}`,
+      0,
+    ],
+    [
+      "explicit host flag outranks GH_REPO",
+      lisaCwd,
+      `gh issue create --repo ${host} --title t --body-file ${body}`,
+      0,
+      { GH_REPO: lisa },
+    ],
+    [
+      "quoted directory separator stays literal",
+      lisaCwd,
+      `cd '${quotedHost}' && gh issue create --title t --body-file ${body}`,
+      0,
+    ],
+    [
+      "quoted body separators cannot redirect target",
+      lisaCwd,
+      `gh pr create --title t --body '${fixtureName}; cd ${hostCwd} && gh issue create'`,
+      2,
+    ],
+    [
+      "quoted repository-flag body stays prose",
+      lisaCwd,
+      `gh issue create --body '--repo=${host}'`,
+      2,
+    ],
+    [
+      "last repository alias selects protected target",
+      hostCwd,
+      `gh issue create --repo ${host} -R ${lisa} --body-file ${body}`,
+      2,
+    ],
+    [
+      "last repository alias selects host target",
+      lisaCwd,
+      `gh issue create --repo ${lisa} -R ${host} --body-file ${body}`,
+      0,
+    ],
+    [
+      "last method alias makes a POST",
+      hostCwd,
+      `gh api repos/${lisa}/issues -X GET --method POST -F body=@${body}`,
+      2,
+    ],
+    [
+      "last method alias keeps explicit GET read-only",
+      hostCwd,
+      `gh api repos/${lisa}/issues -X POST --method GET -F body=@${body}`,
+      0,
+    ],
+    [
+      "attached -F defaults to POST",
+      hostCwd,
+      `gh api repos/${lisa}/issues -Fbody=@${body}`,
+      2,
+    ],
+    [
+      "attached -R permits host target",
+      lisaCwd,
+      `gh issue create -R${host} --body-file ${body}`,
+      0,
+    ],
+    [
+      "unsupported cwd prefix retains protection",
+      hostCwd,
+      `pushd '${lisaCwd}' && gh issue create --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "unresolved cwd retains protection",
+      hostCwd,
+      `cd "$UNKNOWN_DIRECTORY" && gh issue create --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "ambiguous unselected remotes retain protection",
+      ambiguous,
+      `gh issue create --body-file ${body}`,
+      2,
+    ],
+    [
+      "host API placeholders resolve safely",
+      hostCwd,
+      `gh api 'repos/{owner}/{repo}/issues' -f body=${fixtureName}`,
+      0,
+    ],
+    [
+      "unresolved repository flag retains protection",
+      hostCwd,
+      `gh issue create --repo '$UNKNOWN_REPOSITORY' --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "each command in a list retains protection",
+      hostCwd,
+      `gh issue create --repo ${host} --body ${fixtureName}; gh issue create --repo ${lisa} --body ${fixtureName}`,
+      2,
+    ],
+    [
+      "actual cwd is separate from detector root",
+      relative,
+      `gh issue create --repo ${lisa} --body-file body.md`,
+      2,
+      { CLAUDE_PROJECT_DIR: lisaCwd },
+    ],
+    [
+      "unknown cwd cannot silently inspect a relative body file elsewhere",
+      lisaCwd,
+      'cd "$UNKNOWN_DIRECTORY" && gh issue create --repo CodySwannGT/lisa --body-file body.md',
+      2,
+      {},
+      "BLOCKED: the working directory",
+    ],
+    [
+      "unknown cwd cannot silently inspect a relative API field elsewhere",
+      lisaCwd,
+      'cd "$UNKNOWN_DIRECTORY" && gh api repos/CodySwannGT/lisa/issues --field body=@body.md',
+      2,
+      {},
+      "BLOCKED: the working directory",
+    ],
+  ];
+}