@codyswann/lisa 2.24.0 → 2.25.1

package/plugins/lisa-wiki/templates/llm-wiki-contract.md

@@ -0,0 +1,60 @@
+# {{displayName}} — LLM Wiki Contract
+
+> Generated by the `lisa-wiki` plugin from `{{wikiRoot}}/lisa-wiki.config.json`.
+> kernelVersion: {{kernelVersion}} · schemaVersion: {{schemaVersion}} · rendered: {{generatedDate}}
+> This snapshot keeps the wiki self-describing **without** the plugin installed. Re-render with
+> `/setup --upgrade`; do not hand-edit — change the config instead.
+
+## Purpose
+{{purpose}}
+
+## What this is
+A git-native markdown knowledge base under `{{wikiRoot}}/`, owned by **{{org}}**, maintained by the
+lisa-wiki kernel. Three layers: immutable **raw sources** (`{{wikiRoot}}/sources/`), the LLM-owned
+**synthesis** layer (the category directories), and this **schema** layer (config + this contract).
+Repository mode: **{{mode}}**.
+
+## Layout
+- `{{wikiRoot}}/index.md` — navigation map of every page (read first).
+- `{{wikiRoot}}/log.md` — append-only operation ledger.
+- `{{wikiRoot}}/start-here.md` — orientation + purpose.
+- `{{wikiRoot}}/sources/` — provenance (source notes); layout: **{{sourceLayout}}**.
+- `{{wikiRoot}}/state/` — per-source ingestion cursors (JSON).
+- `{{wikiRoot}}/staff/` — digital-staff role pages (optional).
+- Synthesis categories: {{categories}}.
+
+## Ordered ingestion pipeline (never reorder)
+`source note → synthesis → index → log → verify → state → commit/PR`.
+State advances **only** after source notes + synthesis + index + log + verification all pass.
+Connectors write **only** their source note (+ run metadata); the kernel performs synthesis, index,
+log, verification, state advancement, and PR.
+
+## Standards
+- Frontmatter required on new/touched synthesis pages and source notes
+  (`type`, `created`, `updated`, `related`, `sources`[, `sensitivity`]).
+- `index.md` is a per-category table; `log.md` is an append-only table with the fixed operation
+  vocabulary: `INIT, SETUP, INGEST, CREATE, UPDATE, MERGE, DEPRECATE, LINT, QUERY, REBUILD-INDEX`.
+- Cite sources in plain text, e.g. `Source: {{wikiRoot}}/sources/<system>/<note>.md`.
+- Do not invent facts; weak or unverified material → `{{wikiRoot}}/open-questions/`.
+
+## Sources & connectors
+Enabled connectors: {{connectors}}.
+Universal sources every project may ingest: self + other registered projects' git/PR history,
+**project-scoped** memory, and roles. **Memory is project-scoped ONLY — never global/unrelated.**
+External-write connectors (e.g. Slack OAuth, CRM writeback) run only with explicit intent and never
+auto-merge. A bare full ingest runs every enabled non-external-write source.
+
+## Safety
+- Source retention: **{{sourceRetention}}**. Default sensitivity: **{{sensitivityDefault}}**.
+- Pre-commit: `git diff --check`, secret scan, tenant/contamination scan, touched-file guard.
+- Never commit secrets/OAuth artifacts. In wrapper/standalone modes, never stage child-repo contents.
+
+## Git
+{{prPolicy}}.
+
+## README
+Mode: **{{readmeMode}}** (rich keeps the public README; stub points to `/onboard-me`; preserve leaves it).
+
+## Commands
+`/ingest` · `/query` · `/lint` · `/setup` · `/migrate` · `/add-ingest` · `/add-role` · `/onboard-me` · `/doctor`
+(On Codex, invoke the matching `lisa-wiki-*` skills, e.g. `$lisa-wiki-ingest`.)

package/plugins/lisa-wiki/templates/log.md

@@ -0,0 +1,8 @@
+# {{displayName}} — Log
+
+> Append-only. One row per operation. Operations:
+> `INIT, SETUP, INGEST, CREATE, UPDATE, MERGE, DEPRECATE, LINT, QUERY, REBUILD-INDEX`.
+
+| Date | Operation | Target | Notes |
+|---|---|---|---|
+| {{generatedDate}} | SETUP | {{wikiRoot}}/ | Initialized {{displayName}} with the lisa-wiki kernel. |

package/plugins/lisa-wiki/templates/page-types/architecture.md

@@ -0,0 +1,18 @@
+---
+type: architecture
+created: {{date}}
+updated: {{date}}
+related: []
+sources: []
+---
+
+# {{title}}
+
+## Overview
+
+## Components
+
+## Data flow
+
+## Constraints & decisions
+<!-- Link relevant decision/ pages; cite source notes -->

package/plugins/lisa-wiki/templates/page-types/concept.md

@@ -0,0 +1,18 @@
+---
+type: concept
+created: {{date}}
+updated: {{date}}
+related: []
+sources: []
+---
+
+# {{title}}
+
+## Definition
+
+## Key points
+
+## Evidence
+<!-- Cite source notes, e.g. Source: sources/<system>/<note>.md -->
+
+## Open questions

package/plugins/lisa-wiki/templates/page-types/decision.md

@@ -0,0 +1,18 @@
+---
+type: decision
+created: {{date}}
+updated: {{date}}
+related: []
+sources: []
+---
+
+# {{title}}
+
+## Context
+
+## Decision
+
+## Consequences
+
+## Status
+<!-- proposed | accepted | superseded -->

package/plugins/lisa-wiki/templates/page-types/entity.md

@@ -0,0 +1,19 @@
+---
+type: entity
+created: {{date}}
+updated: {{date}}
+related: []
+sources: []
+---
+
+# {{title}}
+
+## Overview
+
+## Key capabilities
+
+## Relationships
+<!-- People, products, systems this entity connects to -->
+
+## Context & evidence
+<!-- Cite source notes -->

package/plugins/lisa-wiki/templates/page-types/open-question.md

@@ -0,0 +1,18 @@
+---
+type: open-question
+created: {{date}}
+updated: {{date}}
+related: []
+sources: []
+---
+
+# {{title}}
+
+## The question
+
+## What we know
+<!-- Cite source notes; this is where weak/unverified material lives until confirmed -->
+
+## What we still need
+
+## Owner

package/plugins/lisa-wiki/templates/page-types/playbook.md

@@ -0,0 +1,18 @@
+---
+type: playbook
+created: {{date}}
+updated: {{date}}
+related: []
+sources: []
+---
+
+# {{title}}
+
+## When to use
+
+## Steps
+
+## Verification
+<!-- How to confirm it worked -->
+
+## Pitfalls

package/plugins/lisa-wiki/templates/page-types/project.md

@@ -0,0 +1,19 @@
+---
+type: project
+created: {{date}}
+updated: {{date}}
+related: []
+sources: []
+---
+
+# {{title}}
+
+## Repository
+<!-- | Field | Value | : local path, remote, default branch, HEAD, status -->
+
+## Technology signals
+
+## Structure signals
+
+## Notes & evidence
+<!-- Cite source notes, e.g. PR #/commit -->

package/plugins/lisa-wiki/templates/page-types/requirement.md

@@ -0,0 +1,19 @@
+---
+type: requirement
+created: {{date}}
+updated: {{date}}
+related: []
+sources: []
+---
+
+# {{title}}
+
+## Summary
+
+## Acceptance criteria
+<!-- Gherkin: Given / When / Then -->
+
+## Out of scope
+
+## Notes & evidence
+<!-- Cite source notes -->

package/plugins/lisa-wiki/templates/page-types/staff.md

@@ -0,0 +1,26 @@
+---
+type: staff
+created: {{date}}
+updated: {{date}}
+related: []
+sources: []
+sensitivity: {{sensitivity}}
+---
+
+# {{role}} ({{id}})
+
+## Role
+<!-- Human or Agent; what this role is responsible for -->
+
+## Domain
+Owned categories: {{ownedCategories}}
+Owned connectors: {{ownedConnectors}}
+
+## Expertise
+{{expertise}}
+
+## Reports to
+
+## Notes
+<!-- The runnable subagent for this role lives at .claude/agents/{{id}}.md and .codex/agents/{{id}}.toml.
+     Whether it is ever invoked/scheduled is out of scope for the wiki. -->

package/plugins/lisa-wiki/templates/start-here.md

@@ -0,0 +1,24 @@
+# Start here — {{displayName}}
+
+## Purpose
+{{purpose}}
+
+## What this is
+A git-native LLM Wiki owned by **{{org}}** and maintained by the `lisa-wiki` kernel. It is the
+durable home for this project's knowledge (and documentation). Raw sources are preserved under
+`{{wikiRoot}}/sources/`; distilled knowledge lives in the category pages; the rules are in
+`{{wikiRoot}}/schema/llm-wiki-contract.md`.
+
+## How to use it
+- **New here?** Run `/onboard-me` (Codex: `$lisa-wiki-onboard-me`) for a guided tour + sample questions.
+- **Find/answer something:** `/query "<question>"` — cited answers from the wiki.
+- **Add knowledge:** `/ingest <url|file|prompt>` (Codex: `$lisa-wiki-ingest`), or `/ingest` with no
+  argument for a full ingest across all enabled non-external-write sources (external-write sources
+  require explicit intent).
+- **Browse:** [index.md](index.md).
+- **Check health:** `/lint`.
+
+## Map
+Synthesis categories: {{categories}}.
+Sources: `{{wikiRoot}}/sources/` · State: `{{wikiRoot}}/state/` · Contract:
+`{{wikiRoot}}/schema/llm-wiki-contract.md` · Log: `{{wikiRoot}}/log.md`.

package/plugins/lisa-wiki/templates/state-readme.md

@@ -0,0 +1,20 @@
+# state/ — ingestion cursors
+
+JSON cursors that let ingestion resume incrementally — one file per source/connector at
+`state/<system>/*.json`. A cursor is advanced **only after** its source notes + synthesis + index +
+log + verification all pass (never before). Common envelope:
+
+```json
+{
+  "connector": "git",
+  "profile": "default",
+  "lastSuccessfulRunAt": "1970-01-01T00:00:00Z",
+  "cursor": {},
+  "sourceNotes": [],
+  "synthesisPages": [],
+  "schemaVersion": "1.0.0"
+}
+```
+
+The post-migration / post-setup verification report is written to
+`state/migration/doctor-report.json` by `/doctor`.

package/plugins/src/base/rules/config-resolution.md

@@ -341,7 +341,38 @@ read_notion_token() {
     Darwin)  security find-generic-password -s lisa-notion -a "$workspace" -w 2>/dev/null ;;
     Linux)   command -v secret-tool >/dev/null && \
              secret-tool lookup service lisa-notion account "$workspace" 2>/dev/null ;;
-    MINGW*|MSYS*|CYGWIN*) cmdkey /list:"lisa-notion-${workspace}" 2>/dev/null | grep Password | awk '{print $NF}' ;;
+    MINGW*|MSYS*|CYGWIN*)
+      # `cmdkey /generic ... /pass:` stores the secret in Windows Credential Manager, but
+      # `cmdkey /list` never prints stored passwords (by design). Read the CredentialBlob
+      # back via the Win32 CredRead API through PowerShell; pass the target name via an env
+      # var to dodge nested quoting, and strip the CRLF powershell.exe appends.
+      LISA_CRED_TARGET="lisa-notion-${workspace}" powershell.exe -NoProfile -NonInteractive -Command '
+Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+public static class LisaCred {
+  [StructLayout(LayoutKind.Sequential)]
+  private struct CREDENTIAL {
+    public int Flags; public int Type; public IntPtr TargetName; public IntPtr Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public int CredentialBlobSize; public IntPtr CredentialBlob; public int Persist;
+    public int AttributeCount; public IntPtr Attributes; public IntPtr TargetAlias; public IntPtr UserName;
+  }
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+  private static extern bool CredRead(string target, int type, int flags, out IntPtr credential);
+  [DllImport("advapi32.dll")] private static extern void CredFree(IntPtr cred);
+  public static string Read(string target) {
+    IntPtr p;
+    if (!CredRead(target, 1, 0, out p)) { return null; }
+    try {
+      CREDENTIAL c = (CREDENTIAL)Marshal.PtrToStructure(p, typeof(CREDENTIAL));
+      if (c.CredentialBlobSize == 0) { return String.Empty; }
+      return Marshal.PtrToStringUni(c.CredentialBlob, c.CredentialBlobSize / 2);
+    } finally { CredFree(p); }
+  }
+}
+"@
+[LisaCred]::Read($env:LISA_CRED_TARGET)' 2>/dev/null | tr -d '\r' ;;
   esac
 }
 ```

package/plugins/src/base/skills/atlassian-access/SKILL.md

@@ -79,7 +79,38 @@ read_atlassian_token() {
   case "$(uname -s)" in
     Darwin)  security find-generic-password -s lisa-atlassian -a "$email" -w 2>/dev/null ;;
     Linux)   command -v secret-tool >/dev/null && secret-tool lookup service lisa-atlassian account "$email" 2>/dev/null ;;
-    MINGW*|MSYS*|CYGWIN*) cmdkey /list:"lisa-atlassian-${email}" 2>/dev/null | grep Password | awk '{print $NF}' ;;
+    MINGW*|MSYS*|CYGWIN*)
+      # `cmdkey /generic ... /pass:` stores the secret in Windows Credential Manager, but
+      # `cmdkey /list` never prints stored passwords (by design). Read the CredentialBlob
+      # back via the Win32 CredRead API through PowerShell; pass the target name via an env
+      # var to dodge nested quoting, and strip the CRLF powershell.exe appends.
+      LISA_CRED_TARGET="lisa-atlassian-${email}" powershell.exe -NoProfile -NonInteractive -Command '
+Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+public static class LisaCred {
+  [StructLayout(LayoutKind.Sequential)]
+  private struct CREDENTIAL {
+    public int Flags; public int Type; public IntPtr TargetName; public IntPtr Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public int CredentialBlobSize; public IntPtr CredentialBlob; public int Persist;
+    public int AttributeCount; public IntPtr Attributes; public IntPtr TargetAlias; public IntPtr UserName;
+  }
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+  private static extern bool CredRead(string target, int type, int flags, out IntPtr credential);
+  [DllImport("advapi32.dll")] private static extern void CredFree(IntPtr cred);
+  public static string Read(string target) {
+    IntPtr p;
+    if (!CredRead(target, 1, 0, out p)) { return null; }
+    try {
+      CREDENTIAL c = (CREDENTIAL)Marshal.PtrToStructure(p, typeof(CREDENTIAL));
+      if (c.CredentialBlobSize == 0) { return String.Empty; }
+      return Marshal.PtrToStringUni(c.CredentialBlob, c.CredentialBlobSize / 2);
+    } finally { CredFree(p); }
+  }
+}
+"@
+[LisaCred]::Read($env:LISA_CRED_TARGET)' 2>/dev/null | tr -d '\r' ;;
   esac
 }
 TOKEN=$(read_atlassian_token "$EMAIL")

package/plugins/src/base/skills/notion-access/SKILL.md

@@ -61,7 +61,38 @@ read_notion_token() {
     Darwin)  security find-generic-password -s lisa-notion -a "$workspace" -w 2>/dev/null ;;
     Linux)   command -v secret-tool >/dev/null && \
              secret-tool lookup service lisa-notion account "$workspace" 2>/dev/null ;;
-    MINGW*|MSYS*|CYGWIN*) cmdkey /list:"lisa-notion-${workspace}" 2>/dev/null | grep Password | awk '{print $NF}' ;;
+    MINGW*|MSYS*|CYGWIN*)
+      # `cmdkey /generic ... /pass:` stores the secret in Windows Credential Manager, but
+      # `cmdkey /list` never prints stored passwords (by design). Read the CredentialBlob
+      # back via the Win32 CredRead API through PowerShell; pass the target name via an env
+      # var to dodge nested quoting, and strip the CRLF powershell.exe appends.
+      LISA_CRED_TARGET="lisa-notion-${workspace}" powershell.exe -NoProfile -NonInteractive -Command '
+Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+public static class LisaCred {
+  [StructLayout(LayoutKind.Sequential)]
+  private struct CREDENTIAL {
+    public int Flags; public int Type; public IntPtr TargetName; public IntPtr Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public int CredentialBlobSize; public IntPtr CredentialBlob; public int Persist;
+    public int AttributeCount; public IntPtr Attributes; public IntPtr TargetAlias; public IntPtr UserName;
+  }
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+  private static extern bool CredRead(string target, int type, int flags, out IntPtr credential);
+  [DllImport("advapi32.dll")] private static extern void CredFree(IntPtr cred);
+  public static string Read(string target) {
+    IntPtr p;
+    if (!CredRead(target, 1, 0, out p)) { return null; }
+    try {
+      CREDENTIAL c = (CREDENTIAL)Marshal.PtrToStructure(p, typeof(CREDENTIAL));
+      if (c.CredentialBlobSize == 0) { return String.Empty; }
+      return Marshal.PtrToStringUni(c.CredentialBlob, c.CredentialBlobSize / 2);
+    } finally { CredFree(p); }
+  }
+}
+"@
+[LisaCred]::Read($env:LISA_CRED_TARGET)' 2>/dev/null | tr -d '\r' ;;
   esac
 }
 TOKEN=$(read_notion_token "$WORKSPACE")

package/plugins/src/base/skills/setup-atlassian/SKILL.md

@@ -80,7 +80,38 @@ read_token() {
   case "$(uname -s)" in
     Darwin)  security find-generic-password -s lisa-atlassian -a "$email" -w 2>/dev/null ;;
     Linux)   command -v secret-tool >/dev/null && secret-tool lookup service lisa-atlassian account "$email" 2>/dev/null ;;
-    MINGW*|MSYS*|CYGWIN*) cmdkey /list:"lisa-atlassian-${email}" 2>/dev/null | grep Password | awk '{print $NF}' ;;
+    MINGW*|MSYS*|CYGWIN*)
+      # `cmdkey /generic ... /pass:` stores the secret in Windows Credential Manager, but
+      # `cmdkey /list` never prints stored passwords (by design). Read the CredentialBlob
+      # back via the Win32 CredRead API through PowerShell; pass the target name via an env
+      # var to dodge nested quoting, and strip the CRLF powershell.exe appends.
+      LISA_CRED_TARGET="lisa-atlassian-${email}" powershell.exe -NoProfile -NonInteractive -Command '
+Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+public static class LisaCred {
+  [StructLayout(LayoutKind.Sequential)]
+  private struct CREDENTIAL {
+    public int Flags; public int Type; public IntPtr TargetName; public IntPtr Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public int CredentialBlobSize; public IntPtr CredentialBlob; public int Persist;
+    public int AttributeCount; public IntPtr Attributes; public IntPtr TargetAlias; public IntPtr UserName;
+  }
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+  private static extern bool CredRead(string target, int type, int flags, out IntPtr credential);
+  [DllImport("advapi32.dll")] private static extern void CredFree(IntPtr cred);
+  public static string Read(string target) {
+    IntPtr p;
+    if (!CredRead(target, 1, 0, out p)) { return null; }
+    try {
+      CREDENTIAL c = (CREDENTIAL)Marshal.PtrToStructure(p, typeof(CREDENTIAL));
+      if (c.CredentialBlobSize == 0) { return String.Empty; }
+      return Marshal.PtrToStringUni(c.CredentialBlob, c.CredentialBlobSize / 2);
+    } finally { CredFree(p); }
+  }
+}
+"@
+[LisaCred]::Read($env:LISA_CRED_TARGET)' 2>/dev/null | tr -d '\r' ;;
   esac
 }
 

package/plugins/src/base/skills/setup-linear/SKILL.md

@@ -85,7 +85,38 @@ read_linear_key() {  # $1=workspace slug
   case "$(uname -s)" in
     Darwin)  security find-generic-password -s lisa-linear -a "$ws" -w 2>/dev/null ;;
     Linux)   command -v secret-tool >/dev/null && secret-tool lookup service lisa-linear account "$ws" 2>/dev/null ;;
-    MINGW*|MSYS*|CYGWIN*) cmdkey /list:"lisa-linear-${ws}" 2>/dev/null | grep Password | awk '{print $NF}' ;;
+    MINGW*|MSYS*|CYGWIN*)
+      # `cmdkey /generic ... /pass:` stores the secret in Windows Credential Manager, but
+      # `cmdkey /list` never prints stored passwords (by design). Read the CredentialBlob
+      # back via the Win32 CredRead API through PowerShell; pass the target name via an env
+      # var to dodge nested quoting, and strip the CRLF powershell.exe appends.
+      LISA_CRED_TARGET="lisa-linear-${ws}" powershell.exe -NoProfile -NonInteractive -Command '
+Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+public static class LisaCred {
+  [StructLayout(LayoutKind.Sequential)]
+  private struct CREDENTIAL {
+    public int Flags; public int Type; public IntPtr TargetName; public IntPtr Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public int CredentialBlobSize; public IntPtr CredentialBlob; public int Persist;
+    public int AttributeCount; public IntPtr Attributes; public IntPtr TargetAlias; public IntPtr UserName;
+  }
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+  private static extern bool CredRead(string target, int type, int flags, out IntPtr credential);
+  [DllImport("advapi32.dll")] private static extern void CredFree(IntPtr cred);
+  public static string Read(string target) {
+    IntPtr p;
+    if (!CredRead(target, 1, 0, out p)) { return null; }
+    try {
+      CREDENTIAL c = (CREDENTIAL)Marshal.PtrToStructure(p, typeof(CREDENTIAL));
+      if (c.CredentialBlobSize == 0) { return String.Empty; }
+      return Marshal.PtrToStringUni(c.CredentialBlob, c.CredentialBlobSize / 2);
+    } finally { CredFree(p); }
+  }
+}
+"@
+[LisaCred]::Read($env:LISA_CRED_TARGET)' 2>/dev/null | tr -d '\r' ;;
   esac
 }
 

package/plugins/src/base/skills/setup-notion/SKILL.md

@@ -167,7 +167,38 @@ read_notion_token() {
   case "$(uname -s)" in
     Darwin)  security find-generic-password -s lisa-notion -a "$workspace" -w 2>/dev/null ;;
     Linux)   command -v secret-tool >/dev/null && secret-tool lookup service lisa-notion account "$workspace" 2>/dev/null ;;
-    MINGW*|MSYS*|CYGWIN*) cmdkey /list:"lisa-notion-${workspace}" 2>/dev/null | grep Password | awk '{print $NF}' ;;
+    MINGW*|MSYS*|CYGWIN*)
+      # `cmdkey /generic ... /pass:` stores the secret in Windows Credential Manager, but
+      # `cmdkey /list` never prints stored passwords (by design). Read the CredentialBlob
+      # back via the Win32 CredRead API through PowerShell; pass the target name via an env
+      # var to dodge nested quoting, and strip the CRLF powershell.exe appends.
+      LISA_CRED_TARGET="lisa-notion-${workspace}" powershell.exe -NoProfile -NonInteractive -Command '
+Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+public static class LisaCred {
+  [StructLayout(LayoutKind.Sequential)]
+  private struct CREDENTIAL {
+    public int Flags; public int Type; public IntPtr TargetName; public IntPtr Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public int CredentialBlobSize; public IntPtr CredentialBlob; public int Persist;
+    public int AttributeCount; public IntPtr Attributes; public IntPtr TargetAlias; public IntPtr UserName;
+  }
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+  private static extern bool CredRead(string target, int type, int flags, out IntPtr credential);
+  [DllImport("advapi32.dll")] private static extern void CredFree(IntPtr cred);
+  public static string Read(string target) {
+    IntPtr p;
+    if (!CredRead(target, 1, 0, out p)) { return null; }
+    try {
+      CREDENTIAL c = (CREDENTIAL)Marshal.PtrToStructure(p, typeof(CREDENTIAL));
+      if (c.CredentialBlobSize == 0) { return String.Empty; }
+      return Marshal.PtrToStringUni(c.CredentialBlob, c.CredentialBlobSize / 2);
+    } finally { CredFree(p); }
+  }
+}
+"@
+[LisaCred]::Read($env:LISA_CRED_TARGET)' 2>/dev/null | tr -d '\r' ;;
   esac
 }
 

package/plugins/src/wiki/.claude-plugin/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "lisa-wiki",
+  "version": "1.0.0",
+  "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
+  "author": { "name": "Cody Swann" }
+}

package/plugins/src/wiki/ci/lisa-wiki-validate.yml

@@ -0,0 +1,32 @@
+# lisa-wiki validation — OPTIONAL. Installed into a project by `/setup --with-ci`.
+#
+# Runs the deterministic wiki validators on pull requests that touch the wiki.
+# Node-only, no extra dependencies (the validators are dependency-free).
+#
+# LISA_WIKI_SCRIPTS must point at the installed plugin's scripts/ directory.
+# `/setup --with-ci` wires this — either by resolving the installed plugin path or
+# by vendoring the plugin's scripts/ into the repo (default below: .lisa-wiki/scripts).
+name: 🧠 LLM Wiki Validate
+
+on:
+  pull_request:
+    paths:
+      - 'wiki/**'
+      - '.lisa-wiki/**'
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    env:
+      LISA_WIKI_SCRIPTS: ${{ vars.LISA_WIKI_SCRIPTS || '.lisa-wiki/scripts' }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Validate config
+        run: node "$LISA_WIKI_SCRIPTS/validate-config.mjs" wiki/lisa-wiki.config.json
+
+      - name: Lint wiki (strict — warnings block once the repo is at hard-enforcement)
+        run: node "$LISA_WIKI_SCRIPTS/lint-wiki.mjs" --wiki wiki --config wiki/lisa-wiki.config.json --strict

package/plugins/src/wiki/commands/add-ingest.md

@@ -0,0 +1,6 @@
+---
+description: "Scaffold a project-specific front-door ingest skill that does something unique (classify a source, fetch from a special system, stamp domain frontmatter) and then chains into /ingest. Extends ingestion without forking the kernel."
+argument-hint: "<short name for the new ingest path>"
+---
+
+Use the lisa-wiki-add-ingest skill to generate a thin, registered front-door ingest skill: interview the project for the source type, bucket, frontmatter, and side-effect class; emit a lisa-wiki-local-<name> skill that enriches then chains into /ingest; and register it under customConnectors. $ARGUMENTS

package/plugins/src/wiki/commands/add-role.md

@@ -0,0 +1,6 @@
+---
+description: "Scaffold a domain-expert digital-staff role over the wiki — a dual-runtime subagent (Claude + Codex) plus a staff doc page — from a config.staff[] entry. The plugin only sets the subagent up; running/scheduling it is out of scope."
+argument-hint: "<role name, e.g. Legal | Finance | Sales>"
+---
+
+Use the lisa-wiki-add-role skill to turn a role into a wiki/staff/<id>.md doc page and brain-pointed subagents on both runtimes (Claude .claude/agents/<id>.md + Codex .codex/agents/<id>.toml), pointed at the role's owned wiki domain. Setup-only — invocation/scheduling/routing is out of scope. $ARGUMENTS

package/plugins/src/wiki/commands/doctor.md

@@ -0,0 +1,6 @@
+---
+description: "Verify that the wiki is correctly set up and (after migration) fully functional. Runs deterministic checks plus functional smoke tests, writes a doctor report, and returns an overall verdict (READY / READY_WITH_WARNINGS / NOT_READY). The final gate of /migrate; re-runnable anytime."
+argument-hint: "[--migration]"
+---
+
+Use the lisa-wiki-doctor skill to run the post-migration/post-setup verification checklist: structure & config, integrity & safety, no-loss/parity, runtime surfaces on both runtimes, functional smoke tests (no extra PR), mode-specific, and git/CI/distribution. Write wiki/state/migration/doctor-report.json and report the verdict + blocking items. $ARGUMENTS

package/plugins/src/wiki/commands/ingest.md

@@ -0,0 +1,6 @@
+---
+description: "Ingest source material into the LLM Wiki. With an argument (URL, file path, or prompt) ingest that one source; with no argument run a full ingest across every enabled non-external-write source. Routes to the right connector and runs the ordered pipeline (source note → synthesis → index → log → verify → state → commit/PR)."
+argument-hint: "[url | file path | prompt]   (omit for a full ingest)"
+---
+
+Use the lisa-wiki-ingest skill to ingest into the wiki: route the input to the right connector (or, with no argument, run a full ingest across all enabled non-external-write sources), then run the ordered pipeline — sanitized source note, synthesis with citations, index, log, verification, and state advancement, then commit/PR per policy. $ARGUMENTS

package/plugins/src/wiki/commands/lint.md

@@ -0,0 +1,6 @@
+---
+description: "Health-check the LLM Wiki: orphan pages, contradictions, stale claims, broken internal links, missing index/log coverage, structure violations, and secret/tenant leaks. Read-only — reports findings, does not fix them."
+argument-hint: ""
+---
+
+Use the lisa-wiki-lint skill to run the wiki's integrity checks and report findings by severity (PASS/WARN/FAIL). It diagnoses only — fixes go through /ingest, /setup, or /migrate. $ARGUMENTS

package/plugins/src/wiki/commands/migrate.md

@@ -0,0 +1,6 @@
+---
+description: "Migrate an existing hand-rolled wiki onto the lisa-wiki kernel — phased and compatibility-first, with a strict no-loss guarantee (renaming is fine; losing functionality or data is not). Ends by running /doctor."
+argument-hint: "[--phase <0|1|1b|2|3|4|5>]"
+---
+
+Use the lisa-wiki-migrate skill to move this repo's bespoke wiki onto the kernel in reviewable phases: inventory, adopt kernel, absorb documentation, consolidate runtime + connectors, normalize by touch, then hard-enforce — parity-checking each migrated artifact before deleting the old one, and finishing with /doctor. $ARGUMENTS

package/plugins/src/wiki/commands/onboard-me.md

@@ -0,0 +1,6 @@
+---
+description: "Onboard a user to the project via its LLM Wiki: interview them about themselves in relation to the project, then give a guided tour and sample questions. Read-mostly by default (session-local); --save-memory persists the capture to project-scoped memory only. No PRs, no PII written into the wiki, never global memory."
+argument-hint: "[--save-memory] [--write-audience-note]"
+---
+
+Use the lisa-wiki-onboard-me skill to onboard the user: briefly interview their role and goals (read-mostly, session-local by default; with --save-memory persist to project-scoped memory only — never global memory, never PII into the wiki), then summarize what the project is, show the folder map, and offer sample /query prompts tuned to their role. $ARGUMENTS

package/plugins/src/wiki/commands/query.md

@@ -0,0 +1,6 @@
+---
+description: "Answer a question from the LLM Wiki with citations. Reads the index, drills into relevant pages, and synthesizes a cited answer. Read-only by default; files new synthesis back only when explicitly asked."
+argument-hint: "<question>"
+---
+
+Use the lisa-wiki-query skill to answer from the wiki with citations: locate relevant pages via the index, synthesize a cited answer, and say plainly when the wiki cannot support an answer. Read-only unless the user explicitly asks to persist new synthesis. $ARGUMENTS