@codyswann/lisa 2.311.14 → 2.313.0

package/plugins/src/base/skills/lisa-secrets-access/SKILL.md

@@ -0,0 +1,122 @@
+---
+name: lisa-secrets-access
+description: "Vendor-neutral access layer for secrets. Every skill and script that needs an API key MUST resolve it through this skill rather than reading a keychain, an .env file, or a provider CLI directly. Resolves the environment first so CI injection wins, then the configured provider — Bitwarden Secrets Manager, 1Password, AWS Secrets Manager, Doppler or Vault — looked up by key name. Enforces one store per secret, reads usage metadata from the provider's own note field, and never writes."
+allowed-tools: ["Bash", "Read", "Skill"]
+---
+
+# Secrets Access: $ARGUMENTS
+
+Single chokepoint for reading credentials. Caller skills MUST go through this — they MUST NOT read the OS keychain, parse a `.env`, or invoke a provider CLI themselves.
+
+The rule this exists to enforce: **a secret lives in exactly one store.** Every local cache is a copy that will eventually drift from its source, and a drifted copy is indistinguishable from a valid one until something fails in production.
+
+## Invocation contract
+
+```text
+operation: get      name: ATTIO_API_KEY
+operation: list                                  # names only, never values
+operation: describe name: ATTIO_API_KEY          # the usage note, not the value
+operation: verify                                # every declared secret resolves
+```
+
+`get` returns the value on stdout and nothing else. `list` and `describe` never emit a secret value.
+
+## Configuration
+
+In `.lisa.config.json`:
+
+```json
+{
+  "secrets": {
+    "provider": "bitwarden",
+    "bootstrap": { "sources": ["env", "keychain"], "key": "BWS_ACCESS_TOKEN" },
+    "require": ["ATTIO_API_KEY", "SLACK_WEBHOOK_URL"]
+  }
+}
+```
+
+**`provider`** — `bitwarden` | `1password` | `aws` | `doppler` | `vault` | `env`.
+
+**`bootstrap`** — how to obtain the one credential that unlocks the rest. `sources` is ordered: environment first, so CI injection wins over any local copy. This is the **only** credential permitted in a keychain; it is a bootstrap, not a cache.
+
+**`require`** — optional. Omit it and every secret the provider grants is available, which is correct when the provider already scopes access per project. Present, it narrows to exactly those names **and asserts them**: a listed name that does not resolve is a startup error, not a late surprise. Use it when a repo needs a subset of a deliberately broader project.
+
+There is no map of secret IDs, deliberately. Copying an ID per secret is the same duplication in a smaller costume, and lookup is by name.
+
+## The naming convention this rests on
+
+**A secret's key is the exact environment-variable name.** No inference, no fuzzy matching, no case folding. A secret named `attio-prod` will not resolve for `ATTIO_API_KEY`, and the error says so rather than silently returning nothing.
+
+Enforce it: `doctor` should warn on any key that is not a valid `UPPER_SNAKE_CASE` identifier.
+
+## Workflow
+
+### Step 1 — Environment first
+
+If `$<NAME>` is set and non-empty, return it. This is how CI injects secrets, and it means a scheduled run never touches the provider or a local store.
+
+### Step 2 — Bootstrap
+
+Resolve the bootstrap credential by walking `bootstrap.sources` in order. Fail with an actionable message naming where it was looked for.
+
+### Step 3 — Provider lookup by name
+
+| Provider | Read |
+| --- | --- |
+| `bitwarden` | `bws secret list` → index by `key` |
+| `1password` | `op read "op://<vault>/<name>/credential"` |
+| `aws` | `aws secretsmanager get-secret-value --secret-id <name>` |
+| `doppler` | `doppler secrets get <name> --plain` |
+| `vault` | `vault kv get -field=<name> <path>` |
+| `env` | environment only; the provider is the environment |
+
+Cache **in-process only**. Never write a resolved value to disk — that recreates the problem this skill exists to remove.
+
+### Step 4 — Fail loudly and usefully
+
+A missing name reports what *is* visible, so the caller can see immediately whether the secret is absent or merely misnamed:
+
+```text
+GOOGLE_SERVICE_ACCOUNT_JSON is not available to this account.
+Visible: APOLLO_API_KEY, ATTIO_API_KEY, SLACK_WEBHOOK_URL
+A secret's key must be the exact environment variable name.
+```
+
+## Usage metadata lives on the secret
+
+Every provider has a description field — Bitwarden `note`, 1Password notes, AWS `Description`, Doppler notes, Vault custom metadata. **That is where a secret's usage documentation belongs**, not in a config file: a note travels with the secret and therefore cannot drift from it, which is precisely the property config lacks.
+
+Format — first line prose, then `key: value` lines:
+
+```text
+Attio CRM - system of record for the sales funnel.
+scope: object_configuration, record, list_entry - read-write
+owner: <name>
+ci: yes - injected by <mechanism>
+docs: <path>
+```
+
+`describe` returns this. When a note is empty, **infer purpose from the name, mark it inferred, and report the gap** — infer *and* warn, never instead of. A silent fallback that works well enough guarantees the notes stay empty forever.
+
+**An inferred mapping must never authorise a write.** It orients a reader; it does not pick which credential calls a production API. `ATTIO_API_KEY` versus `ATTIO_API_KEY_STAGING` is exactly the guess that silently writes to the wrong system.
+
+## This skill never writes
+
+No create, no update, no rotate. Writing secrets or their notes requires an authority a CI credential should not hold, and a read-only path cannot be turned against the vault if it leaks.
+
+Where a rotating credential must persist a new value — an OAuth refresh token that the issuer replaces on every use — that is a **separate, deliberately-scoped writer**, and exactly one process may hold that loop. Two refreshers race, and each invalidates the other's token silently.
+
+## Doctor checks worth wiring
+
+- Every name in `require` resolves.
+- Every key matches `^[A-Z][A-Z0-9_]*$`.
+- No secret has an empty note.
+- **No secret is readable from two stores.** A value present in both the provider and a local cache is not a duplicate — it is **two live credentials**, one of which is untracked. This is the check most worth having: it catches drift before a deletion turns the forgotten copy into an orphan nobody can revoke.
+
+## Rules
+
+1. **Never read a keychain, `.env`, or provider CLI outside this skill.** One chokepoint is what makes the single-store rule enforceable.
+2. **Never log a secret value.** Print a length or a hash prefix when proving identity.
+3. **Never write a resolved value to disk**, including "temporary" files.
+4. **Verify a credential when it is stored, not when it is first used.** An unverified credential is indistinguishable from a broken one, and the gap between the two is measured in weeks.
+5. **Treat a mismatch as stop-and-ask.** If a value differs between two places, they are two live credentials — not a stale copy to be discarded. Deleting the one you cannot verify leaves a working credential that no record accounts for.

package/plugins/src/base/skills/lisa-secrets-access/scripts/resolve-secret.mjs

@@ -0,0 +1,261 @@
+#!/usr/bin/env node
+/**
+ * Resolve a secret through the configured provider.
+ *
+ * The executable half of `lisa-secrets-access`. It exists as a CLI rather than
+ * a library because the callers are polyglot — Python scripts, shell, and
+ * TypeScript all need the same answer, and a subprocess is the only interface
+ * all three share without duplicating the logic three times.
+ *
+ * Resolution order is environment, then provider. The environment comes first
+ * so a CI run — where secrets are injected by the pipeline — never reaches for
+ * a provider or a local store at all.
+ *
+ * Values are written to stdout with no trailing newline and nothing else, so
+ * `$(resolve-secret.mjs get NAME)` is safe. Diagnostics go to stderr.
+ *
+ * Usage:
+ *   resolve-secret.mjs get NAME
+ *   resolve-secret.mjs list
+ *   resolve-secret.mjs describe NAME
+ *   resolve-secret.mjs verify
+ */
+
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** Config defaults when `.lisa.config.json` carries no `secrets` block. */
+const DEFAULTS = {
+  provider: "env",
+  bootstrap: { sources: ["env"], key: null },
+  require: null,
+};
+
+/**
+ * Read the `secrets` block from `.lisa.config.json`.
+ * @param {string} cwd Directory to look in.
+ * @returns {{provider: string, bootstrap: {sources: string[], key: string|null}, require: string[]|null}}
+ */
+export function readConfig(cwd = process.cwd()) {
+  const path = join(cwd, ".lisa.config.json");
+  if (!existsSync(path)) return DEFAULTS;
+  try {
+    const cfg = JSON.parse(readFileSync(path, "utf8")).secrets;
+    if (!cfg) return DEFAULTS;
+    return {
+      provider: cfg.provider ?? DEFAULTS.provider,
+      bootstrap: { ...DEFAULTS.bootstrap, ...(cfg.bootstrap ?? {}) },
+      require: cfg.require ?? null,
+    };
+  } catch (err) {
+    throw new Error(`.lisa.config.json is not readable: ${err.message}`);
+  }
+}
+
+/**
+ * Obtain the one credential that unlocks the provider.
+ *
+ * Walks `sources` in order. This is the only credential permitted in an OS
+ * keychain — it is a bootstrap, not a cached copy of anything.
+ * @param {{sources: string[], key: string|null}} bootstrap Bootstrap config.
+ * @returns {string|null} The token, or null when the provider needs none.
+ */
+function bootstrapToken(bootstrap) {
+  if (!bootstrap.key) return null;
+  for (const source of bootstrap.sources) {
+    if (source === "env") {
+      const v = (process.env[bootstrap.key] ?? "").trim();
+      if (v) return v;
+    }
+    if (source === "keychain" && process.platform === "darwin") {
+      try {
+        const v = execFileSync(
+          "security",
+          [
+            "find-generic-password",
+            "-s",
+            bootstrap.key,
+            "-a",
+            process.env.USER ?? "",
+            "-w",
+          ],
+          { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
+        ).trim();
+        if (v) return v;
+      } catch {
+        /* not present in the keychain; try the next source */
+      }
+    }
+  }
+  throw new Error(
+    `${bootstrap.key} not found in: ${bootstrap.sources.join(", ")}.\n` +
+      `It is the bootstrap credential — without it no other secret can be read.`
+  );
+}
+
+/**
+ * Fetch every secret the provider grants, keyed by name.
+ *
+ * Deliberately fetches all rather than one: the provider already scopes what
+ * this caller may see, so the set it returns *is* the permitted set, and
+ * re-stating that as a list in config would duplicate a boundary the provider
+ * already enforces.
+ * @param {ReturnType<typeof readConfig>} cfg Resolved config.
+ * @returns {Map<string, {value: string, note: string}>} Secrets by name.
+ */
+function fetchAll(cfg) {
+  const out = new Map();
+  const token = bootstrapToken(cfg.bootstrap);
+  const env = { ...process.env };
+  if (cfg.bootstrap.key && token) env[cfg.bootstrap.key] = token;
+
+  switch (cfg.provider) {
+    case "env":
+      for (const [k, v] of Object.entries(process.env)) {
+        if (/^[A-Z][A-Z0-9_]*$/.test(k))
+          out.set(k, { value: v ?? "", note: "" });
+      }
+      return out;
+
+    case "bitwarden": {
+      const raw = execFileSync("bws", ["secret", "list", "--output", "json"], {
+        encoding: "utf8",
+        env,
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+      for (const s of JSON.parse(raw || "[]")) {
+        out.set(s.key, { value: s.value, note: s.note ?? "" });
+      }
+      return out;
+    }
+
+    case "doppler": {
+      const raw = execFileSync(
+        "doppler",
+        ["secrets", "download", "--no-file", "--format", "json"],
+        {
+          encoding: "utf8",
+          env,
+          stdio: ["ignore", "pipe", "pipe"],
+        }
+      );
+      for (const [k, v] of Object.entries(JSON.parse(raw || "{}"))) {
+        out.set(k, { value: String(v), note: "" });
+      }
+      return out;
+    }
+
+    default:
+      throw new Error(
+        `provider "${cfg.provider}" has no bulk read implemented yet.\n` +
+          `Add one in resolve-secret.mjs — see the dispatch table in SKILL.md.`
+      );
+  }
+}
+
+/**
+ * Resolve one secret: environment first, then the provider.
+ * @param {string} name Environment-variable-style key.
+ * @param {ReturnType<typeof readConfig>} [cfg] Resolved config.
+ * @returns {string} The secret value.
+ */
+export function get(name, cfg = readConfig()) {
+  const fromEnv = (process.env[name] ?? "").trim();
+  if (fromEnv) return fromEnv;
+
+  // A `require` list is an assertion, not just a filter: naming a secret
+  // declares that this project needs it, so asking for one outside the list is
+  // a configuration error rather than a lookup miss.
+  if (cfg.require && !cfg.require.includes(name)) {
+    throw new Error(
+      `${name} is not declared in secrets.require.\n` +
+        `Declared: ${cfg.require.join(", ") || "(none)"}`
+    );
+  }
+
+  const all = fetchAll(cfg);
+  const hit = all.get(name);
+  if (!hit || !hit.value) {
+    throw new Error(
+      `${name} is not available to this account.\n` +
+        `Visible: ${[...all.keys()].sort().join(", ") || "(none)"}\n` +
+        `A secret's key must be the exact environment variable name.`
+    );
+  }
+  return hit.value;
+}
+
+function main() {
+  const [op, name] = process.argv.slice(2);
+  const cfg = readConfig();
+
+  if (op === "get") {
+    if (!name) throw new Error("usage: resolve-secret.mjs get NAME");
+    process.stdout.write(get(name, cfg));
+    return;
+  }
+  if (op === "list") {
+    // Names only. This command must never be able to leak a value.
+    console.log([...fetchAll(cfg).keys()].sort().join("\n"));
+    return;
+  }
+  if (op === "describe") {
+    if (!name) throw new Error("usage: resolve-secret.mjs describe NAME");
+    const hit = fetchAll(cfg).get(name);
+    if (hit) {
+      console.log(
+        hit.note || `(no note — purpose inferred from the name: ${name})`
+      );
+      return;
+    }
+    // Environment-only is a legitimate state, not an error: CI injects secrets
+    // that never appear in the provider listing. Say so rather than claiming
+    // the secret does not exist, and never print the value.
+    if ((process.env[name] ?? "").trim()) {
+      console.log(
+        `(set in the environment; no provider entry, so no note is available)`
+      );
+      return;
+    }
+    throw new Error(`${name} not found in the environment or the provider`);
+  }
+  if (op === "verify") {
+    const all = fetchAll(cfg);
+    const names = cfg.require ?? [...all.keys()];
+    let bad = 0;
+    for (const n of names) {
+      // Mirror get()'s environment-first order. Checking only the provider
+      // reports MISSING for every secret in CI, where the pipeline injects
+      // them as environment variables — a false negative precisely where
+      // verification matters most.
+      const fromEnv = Boolean((process.env[n] ?? "").trim());
+      const entry = all.get(n);
+      const ok = fromEnv || Boolean(entry?.value);
+      const named = /^[A-Z][A-Z0-9_]*$/.test(n);
+      const noted = Boolean(entry?.note);
+      if (!ok || !named) bad += 1;
+      const source = fromEnv
+        ? "env     "
+        : entry?.value
+          ? "provider"
+          : "        ";
+      console.log(
+        `  ${n.padEnd(30)} ${ok ? "resolves" : "MISSING "} ${source}  ` +
+          `${named ? "name ok" : "NAME NOT UPPER_SNAKE"}  ${noted ? "noted" : "no note"}`
+      );
+    }
+    if (bad) throw new Error(`${bad} secret(s) failed verification`);
+    return;
+  }
+  throw new Error("usage: resolve-secret.mjs get|list|describe|verify [NAME]");
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  try {
+    main();
+  } catch (err) {
+    console.error(err.message);
+    process.exit(1);
+  }
+}

package/ui/index.html

@@ -5688,6 +5688,25 @@
                     ],
                     viaValue: "license-checker",
                   },
+                  {
+                    q: "What catches licensed or proprietary code reproduced directly into your source?",
+                    help: "TASC SI10. The allowlist above governs declared dependencies — code a model reproduces from memory, or an agent copies out of a repository it fetched while researching, carries no lockfile entry and no SBOM line, so every scanner above is blind to it. This gate detects verbatim and near-verbatim reuse and holds the merge until the source's license is identified and its obligations discharged. Attribution survives inlining: a permissive license on the allowlist is a permission with conditions, not an absence of them, and a notice file assembled by hand is a control nobody has measured.",
+                    kind: "select",
+                    options: [
+                      "Similarity gate on changed code, with attribution notices generated mechanically",
+                      "Similarity scanning, attribution handled by hand",
+                      "We rely on the model vendor's filter",
+                      "Nothing — review would have to notice",
+                    ],
+                    via: [
+                      "SCANOSS",
+                      "FOSSA",
+                      "Black Duck",
+                      "ScanCode",
+                      "Vendor-side filter",
+                      "None",
+                    ],
+                  },
                 ],
               },
               {
@@ -5725,6 +5744,24 @@
                       "Anything",
                     ],
                   },
+                  {
+                    q: "Which codebases may an agent draw from — and what stops one client's source reaching another's?",
+                    help: "TASC SI10. Reading the web is an injection surface; reading source is a licensing and confidentiality one. The permissible-source boundary — which repositories, corpora and engagement contexts an agent may draw from — has to be enforced by mechanism rather than instruction, because an instruction not to reuse another client's code is a rule with an unmeasured breach rate (AC5.7). Persisted memory and learnings carry source across that boundary exactly as context does, and the harm here is contractual rather than reputational.",
+                    kind: "select",
+                    options: [
+                      "Declared boundary, enforced mechanically, sources recorded per change",
+                      "Declared boundary, enforced by instruction",
+                      "Isolation is per-repo by convention",
+                      "No declared boundary",
+                    ],
+                    via: [
+                      "Per-engagement workspace isolation",
+                      "Sandbox / container scoping",
+                      "Repository allowlist",
+                      "Context provenance log",
+                      "None",
+                    ],
+                  },
                   {
                     q: "Can an agent add a new dependency unreviewed?",
                     help: "Models hallucinate plausible package names and attackers register them (slopsquatting), alongside classic typosquats. An agent that can install unreviewed is the softest supply-chain target there is.",
@@ -5966,7 +6003,7 @@
                 ],
               },
               {
-                label: "Review & merge (AC8.1 · AC5 · AC5.7 · AC8.8)",
+                label: "Review & merge (AC8.1 · AC5 · AC5.7–AC5.9 · AC8.8)",
                 items: [
                   {
                     q: "What reviews every diff before merge?",
@@ -6052,6 +6089,42 @@
                       "We assume the instructions are followed",
                     ],
                   },
+                  {
+                    q: "Where do your control obligations live — and do the gates come from there?",
+                    help: "TASC AC5.8. A rule transcribed into a CI config, a lint rule and an instruction file has three sources of truth and therefore none, and nothing can detect drift between them. Each obligation should be one versioned, machine-readable artifact naming its enforcement tier and the independent mechanism that measures it — a coverage floor that doesn't say which system computes coverage has declared an intention, not a control — with every enforcement point and every agent-facing rendering generated from it.",
+                    kind: "select",
+                    options: [
+                      "Declared as machine-readable artifacts, with enforcement points and agent context generated from them",
+                      "Machine-readable, but each enforcement point is configured separately",
+                      "Written as prose policy documents",
+                      "Only as whatever each tool happens to be configured to do",
+                    ],
+                    via: [
+                      "Policy-as-code in the repo",
+                      "OPA / Rego",
+                      "Generated CI configuration",
+                      "In-house policy engine",
+                      "None",
+                    ],
+                  },
+                  {
+                    q: "Can you enumerate every control, where it is enforced, and when it last fired?",
+                    help: "TASC AC5.9 — the first question an attestor asks, and the one a factory with its control configuration scattered across a pipeline cannot answer. The register carries each obligation's enforcement tier, its measuring mechanism, its last exercised evidence and freshness, measured adherence for the advisory ones, and who answers for it. It has to reconcile both ways against the running system: an obligation with no enforcement point and an enforcement point with no declared obligation are each findings. Unreconciled, a register records what you believe you enforce, and the gap from what you actually enforce is invisible in the direction that matters.",
+                    kind: "select",
+                    options: [
+                      "Live register, reconciled both ways against the running system",
+                      "A register exists, maintained by hand",
+                      "It's spread across CI config, branch rules and instruction files",
+                      "No — we would have to go and look",
+                    ],
+                    via: [
+                      "Generated from policy-as-code",
+                      "Compliance platform",
+                      "In-house control dashboard",
+                      "Spreadsheet",
+                      "None",
+                    ],
+                  },
                   {
                     q: "Is autonomy the same everywhere, or tiered by risk?",
                     help: "TASC AC8.8 — organizations running agent-authored code at scale tier the codebase and decide per tier what agents may do unattended, with whole codebases kept under mandatory human approval. Uniform autonomy is a decision nobody made: a tier no one chose is a tier no one is accountable for.",