@codyswann/lisa 4.84.6 → 4.84.7

package/plugins/src/base/hooks/host-name-command-context.mjs

@@ -103,6 +103,7 @@ function words(command) {
  */
 function argumentsOf(input) {
   const flags = new Map(),
+    fieldOccurrences = [],
     positional = [],
     tokens = [];
   // Any expansion can add/replace routing arguments after shell word splitting.
@@ -139,23 +140,34 @@ function argumentsOf(input) {
         flag === "-R" ? "--repo" : flag === "-X" ? "--method" : flag,
         value
       );
+      // API fields are additive even though routing options use last values.
+      if (FIELD_FLAGS.has(flag)) fieldOccurrences.push([flag, value]);
       tokens.push(value.value);
     } else if (!word.value.startsWith("-")) positional.push(word);
     else if (!word.literal) certain = false;
   }
-  const noun = positional[0]?.value,
-    verb = positional[1]?.value;
+  const nounWord = positional[0],
+    verbWord = positional[1];
+  const noun = nounWord?.literal ? nounWord.value : undefined,
+    verb = verbWord?.value;
+  // Command-name expansions can supply several argv words. A following
+  // read-looking literal does not prove that the expanded command is a read.
+  const uncertainName =
+    nounWord?.literal === false ||
+    (["issue", "pr"].includes(noun) && verbWord?.literal === false);
   const method = flags.get("--method");
   const writes =
-    noun === "api"
+    uncertainName ||
+    (noun === "api"
       ? method
         ? !method.literal || METHODS.has(method.value.toUpperCase())
         : [...FIELD_FLAGS].some(flag => flags.has(flag)) ||
           Boolean(flags.get("--input")?.value)
       : ["issue", "pr"].includes(noun) &&
-        ["create", "comment", "edit"].includes(verb);
+        ["create", "comment", "edit"].includes(verb));
   return {
     flags,
+    fieldOccurrences,
     positional,
     tokens: ["gh", ...tokens],
     noun,

package/scripts/lib/host-name-expanded-command-cases.mjs

@@ -0,0 +1,286 @@
+/** Direct expanded command-name regressions; all identities are synthetic. */
+import assert from "node:assert/strict";
+import { boundedExecFileSync } from "./bounded-spawn.mjs";
+
+/** @param {object} context Isolated actual-wrapper fixtures. @returns {Array[]} Named cases. */
+export function hostNameExpandedCommandCases(context) {
+  const { lisaCwd, unknownCwd, hostCwd, lisa, host, fixtureName, body } =
+    context;
+  const cases = [];
+  for (const [target, cwd, repo] of [
+    ["protected", lisaCwd, ` --repo ${lisa}`],
+    ["unknown", unknownCwd, ""],
+  ]) {
+    for (const [name, noun] of [
+      ["unquoted", "$N"],
+      ["double quoted", '"$N"'],
+      ["braced", '"${N}"'],
+      ["concatenated", 'is"$SUFFIX"'],
+    ]) {
+      cases.push([
+        `expanded noun ${name} ${target} write`,
+        cwd,
+        `gh ${noun} create${repo} --body '${fixtureName}'`,
+        2,
+      ]);
+    }
+    for (const [name, verb] of [
+      ["unquoted", "$V"],
+      ["double quoted", '"$V"'],
+      ["braced", '"${V}"'],
+      ["concatenated", 'cre"$TAIL"'],
+    ]) {
+      cases.push([
+        `expanded verb ${name} ${target} write`,
+        cwd,
+        `gh issue ${verb}${repo} --body '${fixtureName}'`,
+        2,
+      ]);
+    }
+    for (const [name, prefix] of [
+      ["multiple-word noun", "gh $N"],
+      ["multiple-word verb", "gh issue $V"],
+      ["noun before read-looking word", "gh $N view"],
+      ["verb before read-looking word", "gh issue $V view"],
+    ]) {
+      cases.push([
+        `expanded ${name} ${target} write`,
+        cwd,
+        `${prefix}${repo} --body '${fixtureName}'`,
+        2,
+      ]);
+    }
+    for (const [name, args] of [
+      ["API field text", `-F body=${fixtureName}`],
+      ["API field file", `-F body=@${body}`],
+      ["API attached field file", `-Fbody=@${body}`],
+      ["API raw field", `-f body=${fixtureName}`],
+      ["API input file", `--input ${body}`],
+    ]) {
+      cases.push([
+        `expanded noun possible ${name} ${target} write`,
+        cwd,
+        `gh "$N" repos/${lisa}/issues ${args}`,
+        2,
+      ]);
+    }
+    cases.push(
+      [
+        `expanded noun issue body-file ${target} write`,
+        cwd,
+        `gh "$N" create${repo} -F ${body}`,
+        2,
+      ],
+      [
+        `expanded both command positions ${target} write`,
+        cwd,
+        `gh${repo} "$N" "$V" --body '${fixtureName}'`,
+        2,
+      ]
+    );
+  }
+  cases.push(
+    [
+      "expanded PR verb protected body-file write",
+      lisaCwd,
+      `gh pr "$V" --repo ${lisa} --body-file ${body}`,
+      2,
+    ],
+    [
+      "expanded PR verb unknown body-file write",
+      unknownCwd,
+      `gh pr "$V" --body-file ${body}`,
+      2,
+    ],
+    [
+      "expanded noun literal host flag cannot certify target",
+      hostCwd,
+      `gh "$N" create --repo ${host} --body '${fixtureName}'`,
+      2,
+    ],
+    [
+      "expanded-name API GET prose with dynamic filter control",
+      lisaCwd,
+      `gh api repos/${lisa}/issues -X GET -F body=${fixtureName} -q "$FILTER"`,
+      0,
+    ],
+    [
+      "expanded-name API GET input with dynamic filter control",
+      lisaCwd,
+      `gh api repos/${lisa}/issues -X GET --input ${body} -q "$FILTER"`,
+      0,
+    ],
+    [
+      "expanded-name literal host control",
+      hostCwd,
+      `gh issue create --repo ${host} --body '${fixtureName}'`,
+      0,
+    ],
+    [
+      "expanded-name literal protected control",
+      lisaCwd,
+      `gh issue create --repo ${lisa} --body '${fixtureName}'`,
+      2,
+    ],
+    [
+      "expanded-name literal unknown control",
+      unknownCwd,
+      `gh issue create --body '${fixtureName}'`,
+      2,
+    ],
+    [
+      "expanded-name dynamic read filter control",
+      lisaCwd,
+      `gh issue list --repo ${lisa} --json title --jq "$FILTER"`,
+      0,
+    ],
+    [
+      "expanded-name dynamic read selector control",
+      lisaCwd,
+      `gh issue view "$NUMBER" --repo ${lisa} --json title --jq '${fixtureName}'`,
+      0,
+    ],
+    [
+      "expanded-name API GET dynamic filter control",
+      lisaCwd,
+      `gh api repos/${lisa}/issues -X GET -q "$FILTER"`,
+      0,
+    ],
+    [
+      "expanded-name single-quoted noun control",
+      lisaCwd,
+      `gh '$N' create --repo ${lisa} --body '${fixtureName}'`,
+      0,
+    ],
+    [
+      "expanded-name single-quoted verb control",
+      lisaCwd,
+      `gh issue '$V' --repo ${lisa} --body '${fixtureName}'`,
+      0,
+    ],
+    [
+      "expanded-name escaped noun control",
+      lisaCwd,
+      `gh \\$N create --repo ${lisa} --body '${fixtureName}'`,
+      0,
+    ],
+    [
+      "expanded-name quoted non-command control",
+      lisaCwd,
+      `printf '%s' 'gh $N create --repo ${lisa} --body ${fixtureName}'`,
+      0,
+    ],
+    [
+      "expanded-name clean prose control",
+      lisaCwd,
+      `gh "$N" create --repo ${lisa} --body 'A clean report.'`,
+      0,
+    ],
+    [
+      "expanded-name options before noun preserve prose boundaries",
+      lisaCwd,
+      `gh --repo ${lisa} --title 'view list' "$N" create --body '${fixtureName}'`,
+      2,
+    ],
+    [
+      "expanded-name literal host API control",
+      hostCwd,
+      `gh api repos/${host}/issues -F body=${fixtureName}`,
+      0,
+    ]
+  );
+  return cases;
+}
+
+/**
+ * Establish expansion premises with a Bash function that only prints argv.
+ * @param {object} context Synthetic fixtures.
+ * @param {object} env Isolated child environment.
+ * @returns {void}
+ */
+export function verifyExpandedCommandArgv(context, env) {
+  const { lisaCwd, lisa, fixtureName, body } = context;
+  const suffix = ` --repo ${lisa} --body '${fixtureName}'`;
+  for (const [name, command, values, expected] of [
+    [
+      "unquoted noun",
+      `gh $N create${suffix}`,
+      { N: "issue" },
+      ["issue", "create", "--repo", lisa, "--body", fixtureName],
+    ],
+    [
+      "quoted braced noun",
+      `gh "${"${N}"}" create${suffix}`,
+      { N: "issue" },
+      ["issue", "create", "--repo", lisa, "--body", fixtureName],
+    ],
+    [
+      "concatenated noun",
+      `gh is"$SUFFIX" create${suffix}`,
+      { SUFFIX: "sue" },
+      ["issue", "create", "--repo", lisa, "--body", fixtureName],
+    ],
+    [
+      "concatenated verb",
+      `gh issue cre"$TAIL"${suffix}`,
+      { TAIL: "ate" },
+      ["issue", "create", "--repo", lisa, "--body", fixtureName],
+    ],
+    [
+      "multiword noun before read-looking word",
+      `gh $N view${suffix}`,
+      { N: "issue create --title" },
+      [
+        "issue",
+        "create",
+        "--title",
+        "view",
+        "--repo",
+        lisa,
+        "--body",
+        fixtureName,
+      ],
+    ],
+    [
+      "multiword verb before read-looking word",
+      `gh issue $V view${suffix}`,
+      { V: "create --title" },
+      [
+        "issue",
+        "create",
+        "--title",
+        "view",
+        "--repo",
+        lisa,
+        "--body",
+        fixtureName,
+      ],
+    ],
+    [
+      "possible API field file",
+      `gh "$N" repos/${lisa}/issues -F body=@${body}`,
+      { N: "api" },
+      ["api", `repos/${lisa}/issues`, "-F", `body=@${body}`],
+    ],
+  ]) {
+    const argv = boundedExecFileSync(
+      "/bin/bash",
+      ["-c", `gh() { printf '%s\\0' "$@"; }; ${command}`],
+      { cwd: lisaCwd, env: { ...env, ...values }, encoding: "utf8" }
+    )
+      .split("\0")
+      .slice(0, -1);
+    assert.deepEqual(argv, expected, name);
+    console.log(
+      JSON.stringify({
+        localExpandedArgvControl: {
+          name,
+          command,
+          argv,
+          inspectedTrackerWriteExecuted: false,
+          ghImplementation: "Bash argv-only printer",
+        },
+      })
+    );
+  }
+}

package/scripts/lib/host-name-field-occurrence-cases.mjs

@@ -0,0 +1,60 @@
+/** Repeated typed API fields must not hide an earlier unresolved prose file. */
+export function hostNameFieldOccurrenceCases({ lisaCwd, lisa, relative }) {
+  const prefix = 'cd "$D" && gh',
+    endpoint = `repos/${lisa}/issues`,
+    clean = `${lisaCwd}/body.md`,
+    refusal = "BLOCKED: the working directory";
+  const unknown = (name, command) => [name, lisaCwd, command, 2, {}, refusal];
+  return [
+    unknown(
+      "expanded repeated field retains earlier relative prose file",
+      `${prefix} "$N" ${endpoint} --field body=@body.md --field title=clean`
+    ),
+    unknown(
+      "literal API repeated field retains earlier relative prose file",
+      `${prefix} api ${endpoint} --field body=@body.md --field title=clean`
+    ),
+    unknown(
+      "literal API repeated F before absolute clean field retains relative file",
+      `${prefix} api ${endpoint} -F body=@body.md -F title=@${clean}`
+    ),
+    unknown(
+      "expanded repeated F union retains unresolved file control",
+      `${prefix} "$N" ${endpoint} -F body=@body.md -F title=@${clean}`
+    ),
+    unknown(
+      "expanded repeated field body-last control",
+      `${prefix} "$N" ${endpoint} --field title=clean --field body=@body.md`
+    ),
+    [
+      "literal API repeated fields known cwd reads original prose file",
+      lisaCwd,
+      `cd '${relative}' && gh api ${endpoint} --field body=@body.md --field title=clean`,
+      2,
+    ],
+    [
+      "literal API repeated fields GET remains read-only",
+      lisaCwd,
+      `${prefix} api ${endpoint} -X GET --field body=@body.md --field title=clean -q "$FILTER"`,
+      0,
+    ],
+    [
+      "nonadditive body-file last value remains authoritative",
+      lisaCwd,
+      `${prefix} issue create --repo ${lisa} --body-file missing.md --body-file ${clean}`,
+      0,
+    ],
+    unknown(
+      "expanded mixed field aliases retain earlier relative file control",
+      `${prefix} "$N" ${endpoint} --field body=@body.md -F title=@${clean}`
+    ),
+    unknown(
+      "expanded repeated equal field retains earlier relative file",
+      `${prefix} "$N" ${endpoint} --field=body=@body.md --field=title=clean`
+    ),
+    unknown(
+      "literal API repeated attached F retains earlier relative file",
+      `${prefix} api ${endpoint} -Fbody=@body.md -Ftitle=@${clean}`
+    ),
+  ];
+}

package/scripts/verify-host-name-target-scope.mjs

@@ -17,6 +17,11 @@ import path from "node:path";
 import { boundedExecFileSync, boundedSpawnSync } from "./lib/bounded-spawn.mjs";
 import { hostNameTargetCases } from "./lib/host-name-target-cases.mjs";
 import { hostNameReviewCases } from "./lib/host-name-review-cases.mjs";
+import {
+  hostNameExpandedCommandCases,
+  verifyExpandedCommandArgv,
+} from "./lib/host-name-expanded-command-cases.mjs";
+import { hostNameFieldOccurrenceCases } from "./lib/host-name-field-occurrence-cases.mjs";
 
 const root = process.cwd();
 const DETECTOR_RELATIVE = "dist/core/downstream-references.js";
@@ -118,6 +123,15 @@ try {
   const identity = {
     proverCheckoutHead: git(root, ["rev-parse", "HEAD"]),
     proverSha256: digest(new URL(import.meta.url)),
+    caseModules: [
+      "host-name-target-cases.mjs",
+      "host-name-review-cases.mjs",
+      "host-name-expanded-command-cases.mjs",
+      "host-name-field-occurrence-cases.mjs",
+    ].map(file => ({
+      file,
+      sha256: digest(new URL(`./lib/${file}`, import.meta.url)),
+    })),
     payloadRoot,
     payloadPackageVersion: JSON.parse(
       readFileSync(path.join(payloadRoot, "package.json"), "utf8")
@@ -299,7 +313,10 @@ try {
   const cases = [
     ...hostNameTargetCases(context),
     ...hostNameReviewCases(context),
+    ...hostNameExpandedCommandCases(context),
+    ...hostNameFieldOccurrenceCases(context),
   ];
+  verifyExpandedCommandArgv(context, fixtureEnv);
   for (const [
     name,
     cwd,
@@ -330,7 +347,16 @@ try {
     );
     const passed =
       run.status === expected && (expected !== 2 || output.includes(refusal));
-    records.push({ name, expected, actual: run.status, passed, output });
+    records.push({
+      name,
+      cwd,
+      command,
+      overrides,
+      expected,
+      actual: run.status,
+      passed,
+      output,
+    });
     console.log(JSON.stringify(records.at(-1)));
   }
   const failed = records.filter(record => !record.passed);