@codyswann/lisa 4.87.2 → 4.87.4

package/plugins/src/base/skills/lisa-session-manager/scripts/human-answer.mjs

@@ -16,7 +16,10 @@
  * answer, and an ordinary reply such as `[x] option 1` is not a machine tag
  * (#4561). Only then is the author matched, on stable ids only: a GitHub
  * login or numeric id, a Jira accountId, a Linear user id, never a display
- * name or email, which anyone can set. The text is carried as data.
+ * name or email, which anyone can set. An all-digit allowed entry is a
+ * numeric id and matches only the `id` or `accountId` field, never a login,
+ * which its owner chooses and may make all digits (#4571). The text is
+ * carried as data.
  *
  * The question the answer must follow is the comment whose id the manager
  * recorded last; with no recorded id, the latest comment that STARTS with
@@ -46,6 +49,17 @@ const COMMENT_ID_KEYS = ["id", "node_id"];
 /** The author fields that are stable ids, never settable display text. */
 const STABLE_ID_KEYS = ["login", "id", "accountId"];
 
+/**
+ * The author fields an all-digit allowed entry may match. A GitHub login can
+ * be all digits and is chosen by its owner, so a numeric operator id must
+ * never be matched against a login: user `583231` would otherwise pass as the
+ * operator whose numeric id is 583231 (CodySwannGT/lisa#4571).
+ */
+const NUMERIC_ID_KEYS = ["id", "accountId"];
+
+/** An allowed entry that is a numeric account id, never a login. */
+const ALL_DIGITS = /^\d+$/;
+
 /**
  * The string or number values of `keys` on `value`, as strings.
  * @param {unknown} value - Object to read
@@ -126,37 +140,78 @@ function questionIndex(rows, managerCommentIds, authorOf) {
  * the manager's latest question comment ({@link questionIndex}) that is not
  * a machine's ({@link isMachineAuthoredComment}), has text of its own
  * outside quoted lines (a comment made only of `>` lines quotes someone
- * else and answers nothing), and whose author's stable id is allowed. Comments are taken in the order given (chronological).
+ * else and answers nothing), whose author's stable id is allowed, and that
+ * `refuses` does not refuse. Comments are taken in the order given
+ * (chronological).
+ *
+ * A refused reply (one that looks like it holds a credential) is skipped and
+ * reported in `refused`, never returned: returning it made every later cycle
+ * pick the same reply and fail on it again, so a corrected reply posted after
+ * it was never read (CodySwannGT/lisa#4571).
  * @param {{comments: unknown, allowed: readonly string[],
- *   managerCommentIds?: readonly (string|number)[]}} input - The item's
- *   comments, the answerer ids, and the ids the manager posted
+ *   managerCommentIds?: readonly (string|number)[],
+ *   refuses?: (text: string) => string | null | undefined}} input - The
+ *   item's comments, the answerer ids, the ids the manager posted, and why a
+ *   reply's text may not be queued (null when it may)
  * @returns {{answer: {text: string, author: string, at: string|null} | null,
- *   reason: string}} The answer, or null with why there is none
+ *   reason: string, refused?: {id: string|null, author: string, why: string}[]}}
+ *   The answer, or null with why there is none, and (only when any were)
+ *   the replies refused
  */
-export function pickItemAnswer({ comments, allowed, managerCommentIds = [] }) {
+export function pickItemAnswer({
+  comments,
+  allowed,
+  managerCommentIds = [],
+  refuses = () => null,
+}) {
   if (!Array.isArray(comments)) {
     throw new Error('stdin must be JSON {"comments":[...]}');
   }
   const rows = comments.filter(row => row && typeof row === "object");
-  const allow = new Set(allowed.map(String));
-  const authorOf = row =>
-    idsOf(row.author ?? row.user, STABLE_ID_KEYS).find(id => allow.has(id));
+  const allow = allowed.map(String);
+  const numeric = new Set(allow.filter(id => ALL_DIGITS.test(id)));
+  const named = new Set(allow.filter(id => !ALL_DIGITS.test(id)));
+  const authorOf = row => {
+    const author = row.author ?? row.user;
+    return (
+      idsOf(author, NUMERIC_ID_KEYS).find(id => numeric.has(id)) ??
+      idsOf(author, STABLE_ID_KEYS).find(id => named.has(id))
+    );
+  };
   const asked = questionIndex(rows, managerCommentIds, authorOf);
+  const refused = [];
   if (asked === -1) return { answer: null, reason: "no-question-comment" };
-  const reply = rows
+  const withRefused = result =>
+    refused.length > 0 ? { ...result, refused } : result;
+  const replies = rows
     .slice(asked + 1)
     .filter(row => !isMachineAuthoredComment(row, { managerCommentIds }))
-    .find(
+    .filter(
       row => authorOf(row) !== undefined && unquoted(bodyOf(row)).trim() !== ""
     );
-  if (!reply) return { answer: null, reason: "no-answer-yet" };
-  const at = reply.createdAt ?? reply.created ?? reply.created_at ?? null;
-  return {
-    answer: {
-      text: bodyOf(reply).trim(),
-      author: authorOf(reply),
-      at: typeof at === "string" ? at : null,
-    },
-    reason: "answered",
-  };
+  for (const reply of replies) {
+    const text = bodyOf(reply).trim();
+    const why = refuses(text);
+    if (why) {
+      refused.push({
+        id: idsOf(reply, COMMENT_ID_KEYS)[0] ?? null,
+        author: authorOf(reply),
+        why,
+      });
+      continue;
+    }
+    const at = reply.createdAt ?? reply.created ?? reply.created_at ?? null;
+    return withRefused({
+      answer: {
+        text,
+        author: authorOf(reply),
+        at: typeof at === "string" ? at : null,
+      },
+      reason: "answered",
+    });
+  }
+  return withRefused({
+    answer: null,
+    reason: refused.length > 0 ? "credential-refused" : "no-answer-yet",
+  });
 }

package/plugins/src/base/skills/lisa-session-manager/scripts/ledger.mjs

@@ -297,7 +297,9 @@ export function recordSpawn(
       startedAt: at,
       lastProgressAt: at,
       logsHash: null,
-      pendingQuestion: null,
+      // Kept, never reset: only clearPendingQuestion clears a question, once
+      // its answer is delivered and the marker removed (lisa#4571).
+      pendingQuestion: previous.pendingQuestion ?? null,
       reason: null,
       finishedAt: null,
       attempts,
@@ -354,7 +356,9 @@ export function recordFinish(projectRoot, { ref, status, reason }, seams) {
       status,
       reason,
       finishedAt: at,
-      pendingQuestion: null,
+      // Kept: a question recorded before the finish still holds its answer
+      // and the tracker marker the manager must remove (lisa#4571).
+      pendingQuestion: previous.pendingQuestion ?? null,
       history: [
         ...(previous.history ?? []),
         { event: "finish", at, status, reason },

package/plugins/src/base/skills/lisa-session-manager/scripts/token-migrate.mjs

@@ -62,8 +62,9 @@ export function digest(value) {
  * of anything else in it (values are never kept or reported).
  * @param {string} stateDir - Resolved state dir
  * @param {Pick<import("node:fs"), "existsSync" | "readFileSync">} fs - Seam
- * @returns {{ path: string, token: string | undefined, others: string[] } |
- *   null} The file, or null when absent
+ * @returns {{ path: string, token: string | undefined, tokenLines: number,
+ *   others: string[] } | null} The file, or null when absent; `token` is the
+ *   first `TELEGRAM_BOT_TOKEN` line's value and `tokenLines` counts them all
  */
 export function readEnvFile(stateDir, fs) {
   const file = path.join(stateDir, TOKEN_FILE);
@@ -74,10 +75,12 @@ export function readEnvFile(stateDir, fs) {
     .map((line, at) => ({ line: line.trim(), at }))
     .filter(({ line }) => line !== "" && !line.startsWith("#"))
     .map(({ line, at }) => ({ match: ENV_LINE.exec(line), at }));
-  const token = entries.find(({ match }) => match?.[1] === TOKEN_VAR)?.match;
+  const tokenLines = entries.filter(({ match }) => match?.[1] === TOKEN_VAR);
+  const token = tokenLines[0]?.match;
   return {
     path: file,
     token: token ? token[2].replace(/^(['"])(.*)\1$/, "$2") : undefined,
+    tokenLines: tokenLines.length,
     others: entries
       .filter(({ match }) => match?.[1] !== TOKEN_VAR)
       .map(({ match, at }) => match?.[1] ?? `an unrecognised line ${at + 1}`),
@@ -109,6 +112,15 @@ export function removable(file) {
  */
 export function assertMigratable(file) {
   if (file === null) return;
+  // Only the first line's token is verified, and the whole file is deleted
+  // after, so a later line would be lost unverified (CodySwannGT/lisa#4571).
+  if ((file.tokenLines ?? 0) > 1) {
+    throw setupError(
+      `${file.path} has ${file.tokenLines} ${TOKEN_VAR} lines, so which ` +
+        `token is meant is ambiguous. Keep exactly one, then run store-token ` +
+        `again. Nothing was changed.`
+    );
+  }
   if (file.others.length > 0) {
     throw setupError(
       `${file.path} holds ${file.others.join(", ")} besides ${TOKEN_VAR}, so ` +

package/typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs

@@ -2862,6 +2862,50 @@ export function readReviewSubstitutes(
   return substitutesAtHead(comments, names, headSha, canWrite);
 }
 
+/**
+ * Review states that are a VERDICT — the ones that set or clear an objection.
+ * `COMMENTED` and `PENDING` are absent on purpose: neither withdraws one.
+ */
+const DECISIVE_REVIEW_STATES = new Set([
+  REVIEW_OBJECTION_STATE,
+  "APPROVED",
+  "DISMISSED",
+]);
+
+/**
+ * Reduces reviews to each author's latest decisive review.
+ *
+ * Later wins by `submittedAt` when both reviews carry a parseable one; when
+ * either does not, the later array position wins, which is the reviews
+ * endpoint's chronological order.
+ * @param {ReadonlyArray<{state?: string, author?: string, submittedAt?: string}>} reviews - Reviews, oldest first
+ * @returns {Map<string|symbol, {state?: string, author?: string, submittedAt?: string}>} Latest decisive review per author; each author-less review keys alone
+ */
+function latestDecisiveByAuthor(reviews) {
+  const latest = new Map();
+  for (const review of reviews) {
+    const state = String(review?.state ?? "").toUpperCase();
+    if (!DECISIVE_REVIEW_STATES.has(state)) continue;
+    // An author-less review (a deleted account) is never reduced against
+    // another: two of them are not the same reviewer, so a missing login can
+    // never let one's approval withdraw the other's objection.
+    const author =
+      typeof review?.author === "string" && review.author !== ""
+        ? review.author
+        : Symbol("unknown-author");
+    const prior = latest.get(author);
+    const priorAt = Date.parse(prior?.submittedAt ?? "");
+    const thisAt = Date.parse(review?.submittedAt ?? "");
+    const earlier =
+      prior !== undefined &&
+      Number.isFinite(priorAt) &&
+      Number.isFinite(thisAt) &&
+      thisAt < priorAt;
+    if (!earlier) latest.set(author, review);
+  }
+  return latest;
+}
+
 /**
  * Whether an objection STANDS at this head, from the review objects.
  *
@@ -2880,12 +2924,26 @@ export function readReviewSubstitutes(
  * those were at the merged head. An unfiltered read would have reddened the
  * other two for objections their authors had already addressed.
  *
+ * ## Each reviewer's LATEST verdict at head, not any verdict at head
+ *
+ * A reviewer can object and then approve the SAME commit — a bot running a
+ * request-changes workflow submits `CHANGES_REQUESTED`, the threads get
+ * resolved, and it submits `APPROVED` against the unchanged head a minute
+ * later. GitHub's own `reviewDecision` clears on that approval; counting every
+ * `CHANGES_REQUESTED` at head kept the gate red on an objection its author had
+ * withdrawn (CodySwannGT/lisa#4571). So the head-filtered reviews are reduced
+ * to each author's latest DECISIVE review — `APPROVED`, `CHANGES_REQUESTED` or
+ * `DISMISSED` — ordered by `submittedAt`, with the endpoint's chronological
+ * order breaking ties and standing in when a timestamp is missing. A
+ * `COMMENTED` review does not withdraw an objection, for the same reason it
+ * does not clear GitHub's `reviewDecision`: commenting is not a verdict.
+ *
  * ## Reported, never inferred
  *
  * This says only what the review objects say. It does NOT consult the status
  * description, and nothing about a waiver, a rate limit or an entitlement
  * reaches it — that is the point of having a second input at all.
- * @param {ReadonlyArray<{state?: string, commitSha?: string, author?: string}>} reviews - Review objects
+ * @param {ReadonlyArray<{state?: string, commitSha?: string, author?: string, submittedAt?: string}>} reviews - Review objects, in the endpoint's chronological order
  * @param {string|undefined} headSha - The head commit under inspection
  * @returns {{objected: boolean, reviewers: string[], staleDropped: number}} What stands at head
  */
@@ -2895,7 +2953,7 @@ export function readObjectionAtHead(reviews, headSha) {
     headSha === undefined || headSha === ""
       ? []
       : all.filter(review => review?.commitSha === headSha);
-  const objections = atHead.filter(
+  const objections = [...latestDecisiveByAuthor(atHead).values()].filter(
     review =>
       String(review?.state ?? "").toUpperCase() === REVIEW_OBJECTION_STATE
   );
@@ -2917,7 +2975,7 @@ export function readObjectionAtHead(reviews, headSha) {
  * carries `commit_id`, which is what makes the staleness filter possible.
  * @param {string|number} pr - The pull request
  * @param {string} [repo] - `OWNER/NAME`; defaults to the current repository
- * @returns {Array<{state: string, commitSha: string, author: string}>} Review objects
+ * @returns {Array<{state: string, commitSha: string, author: string, submittedAt: string}>} Review objects
  * @throws {Error} When the slug cannot be resolved or `gh` cannot answer
  */
 export function fetchPullRequestReviews(pr, repo) {
@@ -2929,7 +2987,7 @@ export function fetchPullRequestReviews(pr, repo) {
   }
   return ghApiPaginatedArray(
     `repos/${slug}/pulls/${pr}/reviews?per_page=100`,
-    "[.[] | {state: .state, commitSha: .commit_id, author: .user.login}]"
+    "[.[] | {state: .state, commitSha: .commit_id, author: .user.login, submittedAt: .submitted_at}]"
   );
 }