@codyswann/lisa 2.311.13 → 2.312.0

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.311.13",
+  "version": "2.312.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.311.13",
+  "version": "2.312.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-secrets-access/SKILL.md

@@ -0,0 +1,122 @@
+---
+name: lisa-secrets-access
+description: "Vendor-neutral access layer for secrets. Every skill and script that needs an API key MUST resolve it through this skill rather than reading a keychain, an .env file, or a provider CLI directly. Resolves the environment first so CI injection wins, then the configured provider — Bitwarden Secrets Manager, 1Password, AWS Secrets Manager, Doppler or Vault — looked up by key name. Enforces one store per secret, reads usage metadata from the provider's own note field, and never writes."
+allowed-tools: ["Bash", "Read", "Skill"]
+---
+
+# Secrets Access: $ARGUMENTS
+
+Single chokepoint for reading credentials. Caller skills MUST go through this — they MUST NOT read the OS keychain, parse a `.env`, or invoke a provider CLI themselves.
+
+The rule this exists to enforce: **a secret lives in exactly one store.** Every local cache is a copy that will eventually drift from its source, and a drifted copy is indistinguishable from a valid one until something fails in production.
+
+## Invocation contract
+
+```text
+operation: get      name: ATTIO_API_KEY
+operation: list                                  # names only, never values
+operation: describe name: ATTIO_API_KEY          # the usage note, not the value
+operation: verify                                # every declared secret resolves
+```
+
+`get` returns the value on stdout and nothing else. `list` and `describe` never emit a secret value.
+
+## Configuration
+
+In `.lisa.config.json`:
+
+```json
+{
+  "secrets": {
+    "provider": "bitwarden",
+    "bootstrap": { "sources": ["env", "keychain"], "key": "BWS_ACCESS_TOKEN" },
+    "require": ["ATTIO_API_KEY", "SLACK_WEBHOOK_URL"]
+  }
+}
+```
+
+**`provider`** — `bitwarden` | `1password` | `aws` | `doppler` | `vault` | `env`.
+
+**`bootstrap`** — how to obtain the one credential that unlocks the rest. `sources` is ordered: environment first, so CI injection wins over any local copy. This is the **only** credential permitted in a keychain; it is a bootstrap, not a cache.
+
+**`require`** — optional. Omit it and every secret the provider grants is available, which is correct when the provider already scopes access per project. Present, it narrows to exactly those names **and asserts them**: a listed name that does not resolve is a startup error, not a late surprise. Use it when a repo needs a subset of a deliberately broader project.
+
+There is no map of secret IDs, deliberately. Copying an ID per secret is the same duplication in a smaller costume, and lookup is by name.
+
+## The naming convention this rests on
+
+**A secret's key is the exact environment-variable name.** No inference, no fuzzy matching, no case folding. A secret named `attio-prod` will not resolve for `ATTIO_API_KEY`, and the error says so rather than silently returning nothing.
+
+Enforce it: `doctor` should warn on any key that is not a valid `UPPER_SNAKE_CASE` identifier.
+
+## Workflow
+
+### Step 1 — Environment first
+
+If `$<NAME>` is set and non-empty, return it. This is how CI injects secrets, and it means a scheduled run never touches the provider or a local store.
+
+### Step 2 — Bootstrap
+
+Resolve the bootstrap credential by walking `bootstrap.sources` in order. Fail with an actionable message naming where it was looked for.
+
+### Step 3 — Provider lookup by name
+
+| Provider | Read |
+| --- | --- |
+| `bitwarden` | `bws secret list` → index by `key` |
+| `1password` | `op read "op://<vault>/<name>/credential"` |
+| `aws` | `aws secretsmanager get-secret-value --secret-id <name>` |
+| `doppler` | `doppler secrets get <name> --plain` |
+| `vault` | `vault kv get -field=<name> <path>` |
+| `env` | environment only; the provider is the environment |
+
+Cache **in-process only**. Never write a resolved value to disk — that recreates the problem this skill exists to remove.
+
+### Step 4 — Fail loudly and usefully
+
+A missing name reports what *is* visible, so the caller can see immediately whether the secret is absent or merely misnamed:
+
+```text
+GOOGLE_SERVICE_ACCOUNT_JSON is not available to this account.
+Visible: APOLLO_API_KEY, ATTIO_API_KEY, SLACK_WEBHOOK_URL
+A secret's key must be the exact environment variable name.
+```
+
+## Usage metadata lives on the secret
+
+Every provider has a description field — Bitwarden `note`, 1Password notes, AWS `Description`, Doppler notes, Vault custom metadata. **That is where a secret's usage documentation belongs**, not in a config file: a note travels with the secret and therefore cannot drift from it, which is precisely the property config lacks.
+
+Format — first line prose, then `key: value` lines:
+
+```text
+Attio CRM - system of record for the sales funnel.
+scope: object_configuration, record, list_entry - read-write
+owner: <name>
+ci: yes - injected by <mechanism>
+docs: <path>
+```
+
+`describe` returns this. When a note is empty, **infer purpose from the name, mark it inferred, and report the gap** — infer *and* warn, never instead of. A silent fallback that works well enough guarantees the notes stay empty forever.
+
+**An inferred mapping must never authorise a write.** It orients a reader; it does not pick which credential calls a production API. `ATTIO_API_KEY` versus `ATTIO_API_KEY_STAGING` is exactly the guess that silently writes to the wrong system.
+
+## This skill never writes
+
+No create, no update, no rotate. Writing secrets or their notes requires an authority a CI credential should not hold, and a read-only path cannot be turned against the vault if it leaks.
+
+Where a rotating credential must persist a new value — an OAuth refresh token that the issuer replaces on every use — that is a **separate, deliberately-scoped writer**, and exactly one process may hold that loop. Two refreshers race, and each invalidates the other's token silently.
+
+## Doctor checks worth wiring
+
+- Every name in `require` resolves.
+- Every key matches `^[A-Z][A-Z0-9_]*$`.
+- No secret has an empty note.
+- **No secret is readable from two stores.** A value present in both the provider and a local cache is not a duplicate — it is **two live credentials**, one of which is untracked. This is the check most worth having: it catches drift before a deletion turns the forgotten copy into an orphan nobody can revoke.
+
+## Rules
+
+1. **Never read a keychain, `.env`, or provider CLI outside this skill.** One chokepoint is what makes the single-store rule enforceable.
+2. **Never log a secret value.** Print a length or a hash prefix when proving identity.
+3. **Never write a resolved value to disk**, including "temporary" files.
+4. **Verify a credential when it is stored, not when it is first used.** An unverified credential is indistinguishable from a broken one, and the gap between the two is measured in weeks.
+5. **Treat a mismatch as stop-and-ask.** If a value differs between two places, they are two live credentials — not a stale copy to be discarded. Deleting the one you cannot verify leaves a working credential that no record accounts for.

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/resolve-secret.mjs

@@ -0,0 +1,261 @@
+#!/usr/bin/env node
+/**
+ * Resolve a secret through the configured provider.
+ *
+ * The executable half of `lisa-secrets-access`. It exists as a CLI rather than
+ * a library because the callers are polyglot — Python scripts, shell, and
+ * TypeScript all need the same answer, and a subprocess is the only interface
+ * all three share without duplicating the logic three times.
+ *
+ * Resolution order is environment, then provider. The environment comes first
+ * so a CI run — where secrets are injected by the pipeline — never reaches for
+ * a provider or a local store at all.
+ *
+ * Values are written to stdout with no trailing newline and nothing else, so
+ * `$(resolve-secret.mjs get NAME)` is safe. Diagnostics go to stderr.
+ *
+ * Usage:
+ *   resolve-secret.mjs get NAME
+ *   resolve-secret.mjs list
+ *   resolve-secret.mjs describe NAME
+ *   resolve-secret.mjs verify
+ */
+
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** Config defaults when `.lisa.config.json` carries no `secrets` block. */
+const DEFAULTS = {
+  provider: "env",
+  bootstrap: { sources: ["env"], key: null },
+  require: null,
+};
+
+/**
+ * Read the `secrets` block from `.lisa.config.json`.
+ * @param {string} cwd Directory to look in.
+ * @returns {{provider: string, bootstrap: {sources: string[], key: string|null}, require: string[]|null}}
+ */
+export function readConfig(cwd = process.cwd()) {
+  const path = join(cwd, ".lisa.config.json");
+  if (!existsSync(path)) return DEFAULTS;
+  try {
+    const cfg = JSON.parse(readFileSync(path, "utf8")).secrets;
+    if (!cfg) return DEFAULTS;
+    return {
+      provider: cfg.provider ?? DEFAULTS.provider,
+      bootstrap: { ...DEFAULTS.bootstrap, ...(cfg.bootstrap ?? {}) },
+      require: cfg.require ?? null,
+    };
+  } catch (err) {
+    throw new Error(`.lisa.config.json is not readable: ${err.message}`);
+  }
+}
+
+/**
+ * Obtain the one credential that unlocks the provider.
+ *
+ * Walks `sources` in order. This is the only credential permitted in an OS
+ * keychain — it is a bootstrap, not a cached copy of anything.
+ * @param {{sources: string[], key: string|null}} bootstrap Bootstrap config.
+ * @returns {string|null} The token, or null when the provider needs none.
+ */
+function bootstrapToken(bootstrap) {
+  if (!bootstrap.key) return null;
+  for (const source of bootstrap.sources) {
+    if (source === "env") {
+      const v = (process.env[bootstrap.key] ?? "").trim();
+      if (v) return v;
+    }
+    if (source === "keychain" && process.platform === "darwin") {
+      try {
+        const v = execFileSync(
+          "security",
+          [
+            "find-generic-password",
+            "-s",
+            bootstrap.key,
+            "-a",
+            process.env.USER ?? "",
+            "-w",
+          ],
+          { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
+        ).trim();
+        if (v) return v;
+      } catch {
+        /* not present in the keychain; try the next source */
+      }
+    }
+  }
+  throw new Error(
+    `${bootstrap.key} not found in: ${bootstrap.sources.join(", ")}.\n` +
+      `It is the bootstrap credential — without it no other secret can be read.`
+  );
+}
+
+/**
+ * Fetch every secret the provider grants, keyed by name.
+ *
+ * Deliberately fetches all rather than one: the provider already scopes what
+ * this caller may see, so the set it returns *is* the permitted set, and
+ * re-stating that as a list in config would duplicate a boundary the provider
+ * already enforces.
+ * @param {ReturnType<typeof readConfig>} cfg Resolved config.
+ * @returns {Map<string, {value: string, note: string}>} Secrets by name.
+ */
+function fetchAll(cfg) {
+  const out = new Map();
+  const token = bootstrapToken(cfg.bootstrap);
+  const env = { ...process.env };
+  if (cfg.bootstrap.key && token) env[cfg.bootstrap.key] = token;
+
+  switch (cfg.provider) {
+    case "env":
+      for (const [k, v] of Object.entries(process.env)) {
+        if (/^[A-Z][A-Z0-9_]*$/.test(k))
+          out.set(k, { value: v ?? "", note: "" });
+      }
+      return out;
+
+    case "bitwarden": {
+      const raw = execFileSync("bws", ["secret", "list", "--output", "json"], {
+        encoding: "utf8",
+        env,
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+      for (const s of JSON.parse(raw || "[]")) {
+        out.set(s.key, { value: s.value, note: s.note ?? "" });
+      }
+      return out;
+    }
+
+    case "doppler": {
+      const raw = execFileSync(
+        "doppler",
+        ["secrets", "download", "--no-file", "--format", "json"],
+        {
+          encoding: "utf8",
+          env,
+          stdio: ["ignore", "pipe", "pipe"],
+        }
+      );
+      for (const [k, v] of Object.entries(JSON.parse(raw || "{}"))) {
+        out.set(k, { value: String(v), note: "" });
+      }
+      return out;
+    }
+
+    default:
+      throw new Error(
+        `provider "${cfg.provider}" has no bulk read implemented yet.\n` +
+          `Add one in resolve-secret.mjs — see the dispatch table in SKILL.md.`
+      );
+  }
+}
+
+/**
+ * Resolve one secret: environment first, then the provider.
+ * @param {string} name Environment-variable-style key.
+ * @param {ReturnType<typeof readConfig>} [cfg] Resolved config.
+ * @returns {string} The secret value.
+ */
+export function get(name, cfg = readConfig()) {
+  const fromEnv = (process.env[name] ?? "").trim();
+  if (fromEnv) return fromEnv;
+
+  // A `require` list is an assertion, not just a filter: naming a secret
+  // declares that this project needs it, so asking for one outside the list is
+  // a configuration error rather than a lookup miss.
+  if (cfg.require && !cfg.require.includes(name)) {
+    throw new Error(
+      `${name} is not declared in secrets.require.\n` +
+        `Declared: ${cfg.require.join(", ") || "(none)"}`
+    );
+  }
+
+  const all = fetchAll(cfg);
+  const hit = all.get(name);
+  if (!hit || !hit.value) {
+    throw new Error(
+      `${name} is not available to this account.\n` +
+        `Visible: ${[...all.keys()].sort().join(", ") || "(none)"}\n` +
+        `A secret's key must be the exact environment variable name.`
+    );
+  }
+  return hit.value;
+}
+
+function main() {
+  const [op, name] = process.argv.slice(2);
+  const cfg = readConfig();
+
+  if (op === "get") {
+    if (!name) throw new Error("usage: resolve-secret.mjs get NAME");
+    process.stdout.write(get(name, cfg));
+    return;
+  }
+  if (op === "list") {
+    // Names only. This command must never be able to leak a value.
+    console.log([...fetchAll(cfg).keys()].sort().join("\n"));
+    return;
+  }
+  if (op === "describe") {
+    if (!name) throw new Error("usage: resolve-secret.mjs describe NAME");
+    const hit = fetchAll(cfg).get(name);
+    if (hit) {
+      console.log(
+        hit.note || `(no note — purpose inferred from the name: ${name})`
+      );
+      return;
+    }
+    // Environment-only is a legitimate state, not an error: CI injects secrets
+    // that never appear in the provider listing. Say so rather than claiming
+    // the secret does not exist, and never print the value.
+    if ((process.env[name] ?? "").trim()) {
+      console.log(
+        `(set in the environment; no provider entry, so no note is available)`
+      );
+      return;
+    }
+    throw new Error(`${name} not found in the environment or the provider`);
+  }
+  if (op === "verify") {
+    const all = fetchAll(cfg);
+    const names = cfg.require ?? [...all.keys()];
+    let bad = 0;
+    for (const n of names) {
+      // Mirror get()'s environment-first order. Checking only the provider
+      // reports MISSING for every secret in CI, where the pipeline injects
+      // them as environment variables — a false negative precisely where
+      // verification matters most.
+      const fromEnv = Boolean((process.env[n] ?? "").trim());
+      const entry = all.get(n);
+      const ok = fromEnv || Boolean(entry?.value);
+      const named = /^[A-Z][A-Z0-9_]*$/.test(n);
+      const noted = Boolean(entry?.note);
+      if (!ok || !named) bad += 1;
+      const source = fromEnv
+        ? "env     "
+        : entry?.value
+          ? "provider"
+          : "        ";
+      console.log(
+        `  ${n.padEnd(30)} ${ok ? "resolves" : "MISSING "} ${source}  ` +
+          `${named ? "name ok" : "NAME NOT UPPER_SNAKE"}  ${noted ? "noted" : "no note"}`
+      );
+    }
+    if (bad) throw new Error(`${bad} secret(s) failed verification`);
+    return;
+  }
+  throw new Error("usage: resolve-secret.mjs get|list|describe|verify [NAME]");
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  try {
+    main();
+  } catch (err) {
+    console.error(err.message);
+    process.exit(1);
+  }
+}

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.311.13",
+  "version": "2.312.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-secrets-access/SKILL.md

@@ -0,0 +1,122 @@
+---
+name: lisa-secrets-access
+description: "Vendor-neutral access layer for secrets. Every skill and script that needs an API key MUST resolve it through this skill rather than reading a keychain, an .env file, or a provider CLI directly. Resolves the environment first so CI injection wins, then the configured provider — Bitwarden Secrets Manager, 1Password, AWS Secrets Manager, Doppler or Vault — looked up by key name. Enforces one store per secret, reads usage metadata from the provider's own note field, and never writes."
+allowed-tools: ["Bash", "Read", "Skill"]
+---
+
+# Secrets Access: $ARGUMENTS
+
+Single chokepoint for reading credentials. Caller skills MUST go through this — they MUST NOT read the OS keychain, parse a `.env`, or invoke a provider CLI themselves.
+
+The rule this exists to enforce: **a secret lives in exactly one store.** Every local cache is a copy that will eventually drift from its source, and a drifted copy is indistinguishable from a valid one until something fails in production.
+
+## Invocation contract
+
+```text
+operation: get      name: ATTIO_API_KEY
+operation: list                                  # names only, never values
+operation: describe name: ATTIO_API_KEY          # the usage note, not the value
+operation: verify                                # every declared secret resolves
+```
+
+`get` returns the value on stdout and nothing else. `list` and `describe` never emit a secret value.
+
+## Configuration
+
+In `.lisa.config.json`:
+
+```json
+{
+  "secrets": {
+    "provider": "bitwarden",
+    "bootstrap": { "sources": ["env", "keychain"], "key": "BWS_ACCESS_TOKEN" },
+    "require": ["ATTIO_API_KEY", "SLACK_WEBHOOK_URL"]
+  }
+}
+```
+
+**`provider`** — `bitwarden` | `1password` | `aws` | `doppler` | `vault` | `env`.
+
+**`bootstrap`** — how to obtain the one credential that unlocks the rest. `sources` is ordered: environment first, so CI injection wins over any local copy. This is the **only** credential permitted in a keychain; it is a bootstrap, not a cache.
+
+**`require`** — optional. Omit it and every secret the provider grants is available, which is correct when the provider already scopes access per project. Present, it narrows to exactly those names **and asserts them**: a listed name that does not resolve is a startup error, not a late surprise. Use it when a repo needs a subset of a deliberately broader project.
+
+There is no map of secret IDs, deliberately. Copying an ID per secret is the same duplication in a smaller costume, and lookup is by name.
+
+## The naming convention this rests on
+
+**A secret's key is the exact environment-variable name.** No inference, no fuzzy matching, no case folding. A secret named `attio-prod` will not resolve for `ATTIO_API_KEY`, and the error says so rather than silently returning nothing.
+
+Enforce it: `doctor` should warn on any key that is not a valid `UPPER_SNAKE_CASE` identifier.
+
+## Workflow
+
+### Step 1 — Environment first
+
+If `$<NAME>` is set and non-empty, return it. This is how CI injects secrets, and it means a scheduled run never touches the provider or a local store.
+
+### Step 2 — Bootstrap
+
+Resolve the bootstrap credential by walking `bootstrap.sources` in order. Fail with an actionable message naming where it was looked for.
+
+### Step 3 — Provider lookup by name
+
+| Provider | Read |
+| --- | --- |
+| `bitwarden` | `bws secret list` → index by `key` |
+| `1password` | `op read "op://<vault>/<name>/credential"` |
+| `aws` | `aws secretsmanager get-secret-value --secret-id <name>` |
+| `doppler` | `doppler secrets get <name> --plain` |
+| `vault` | `vault kv get -field=<name> <path>` |
+| `env` | environment only; the provider is the environment |
+
+Cache **in-process only**. Never write a resolved value to disk — that recreates the problem this skill exists to remove.
+
+### Step 4 — Fail loudly and usefully
+
+A missing name reports what *is* visible, so the caller can see immediately whether the secret is absent or merely misnamed:
+
+```text
+GOOGLE_SERVICE_ACCOUNT_JSON is not available to this account.
+Visible: APOLLO_API_KEY, ATTIO_API_KEY, SLACK_WEBHOOK_URL
+A secret's key must be the exact environment variable name.
+```
+
+## Usage metadata lives on the secret
+
+Every provider has a description field — Bitwarden `note`, 1Password notes, AWS `Description`, Doppler notes, Vault custom metadata. **That is where a secret's usage documentation belongs**, not in a config file: a note travels with the secret and therefore cannot drift from it, which is precisely the property config lacks.
+
+Format — first line prose, then `key: value` lines:
+
+```text
+Attio CRM - system of record for the sales funnel.
+scope: object_configuration, record, list_entry - read-write
+owner: <name>
+ci: yes - injected by <mechanism>
+docs: <path>
+```
+
+`describe` returns this. When a note is empty, **infer purpose from the name, mark it inferred, and report the gap** — infer *and* warn, never instead of. A silent fallback that works well enough guarantees the notes stay empty forever.
+
+**An inferred mapping must never authorise a write.** It orients a reader; it does not pick which credential calls a production API. `ATTIO_API_KEY` versus `ATTIO_API_KEY_STAGING` is exactly the guess that silently writes to the wrong system.
+
+## This skill never writes
+
+No create, no update, no rotate. Writing secrets or their notes requires an authority a CI credential should not hold, and a read-only path cannot be turned against the vault if it leaks.
+
+Where a rotating credential must persist a new value — an OAuth refresh token that the issuer replaces on every use — that is a **separate, deliberately-scoped writer**, and exactly one process may hold that loop. Two refreshers race, and each invalidates the other's token silently.
+
+## Doctor checks worth wiring
+
+- Every name in `require` resolves.
+- Every key matches `^[A-Z][A-Z0-9_]*$`.
+- No secret has an empty note.
+- **No secret is readable from two stores.** A value present in both the provider and a local cache is not a duplicate — it is **two live credentials**, one of which is untracked. This is the check most worth having: it catches drift before a deletion turns the forgotten copy into an orphan nobody can revoke.
+
+## Rules
+
+1. **Never read a keychain, `.env`, or provider CLI outside this skill.** One chokepoint is what makes the single-store rule enforceable.
+2. **Never log a secret value.** Print a length or a hash prefix when proving identity.
+3. **Never write a resolved value to disk**, including "temporary" files.
+4. **Verify a credential when it is stored, not when it is first used.** An unverified credential is indistinguishable from a broken one, and the gap between the two is measured in weeks.
+5. **Treat a mismatch as stop-and-ask.** If a value differs between two places, they are two live credentials — not a stale copy to be discarded. Deleting the one you cannot verify leaves a working credential that no record accounts for.