@codyswann/lisa 2.321.2 → 2.321.4

package/plugins/src/base/skills/lisa-secrets-access/scripts/rotate-secret.mjs

@@ -30,7 +30,12 @@
 import { readFileSync } from "node:fs";
 import { hostname } from "node:os";
 
-import { LEASE_KEY, fetchAll, rawByKey, writeSecret } from "./providers.mjs";
+import {
+  LEASE_KEY,
+  fetchRotatable,
+  rawByKey,
+  writeSecret,
+} from "./providers.mjs";
 import { readConfig } from "./surfaces.mjs";
 
 /** How long a lease is honoured before it is treated as abandoned. */
@@ -63,7 +68,10 @@ function assertRotating(name, cfg) {
  * @returns {{value: string, id: string}} The current entry.
  */
 function entryFor(name, cfg) {
-  const hit = fetchAll(cfg).get(name);
+  // Rotation view, not the materialization view: a name may be excluded from
+  // every surface and still need its replacement persisted. assertRotating has
+  // already proved this name is declared in config.
+  const hit = fetchRotatable(cfg).get(name);
   if (!hit) throw new Error(`${name} is not available to this account`);
   if (!hit.id) {
     throw new Error(

package/plugins/src/base/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -37,7 +37,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, delimiter, dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { assertPinned, extractVersion, planToolchain } from "./toolchain.mjs";
@@ -197,6 +197,22 @@ function applyToolchain(tools, dryRun) {
   mkdirSync(binDir, { recursive: true, mode: 0o755 });
   const byName = new Map((tools.install ?? []).map(t => [t.name, t]));
 
+  // Installing a binary somewhere nothing looks is the same as not installing
+  // it. `~/.local/bin` is on PATH by default on a developer workstation and is
+  // NOT on a minimal container, so the toolchain step reported `install bws`,
+  // the file landed at ~/.local/bin/bws mode 755, and the very next step died
+  // with `spawnSync bws ENOENT`.
+  //
+  // This was invisible in every local test because a workstation shell already
+  // exports the directory — the environment doing the hiding was the one used
+  // to verify the fix.
+  //
+  // Prepended, not appended: a pinned-and-checksummed binary must win over
+  // whatever an image happens to ship under the same name.
+  if (!pathContains(binDir)) {
+    process.env.PATH = `${binDir}${delimiter}${process.env.PATH ?? ""}`;
+  }
+
   for (const step of plan) {
     console.log(`  ${step.action.padEnd(8)} ${step.reason}`);
     if (step.action === "install" && !dryRun)
@@ -205,6 +221,19 @@ function applyToolchain(tools, dryRun) {
   return plan;
 }
 
+/**
+ * Whether a directory is already on PATH.
+ *
+ * Compared entry by entry rather than by substring: a substring test would
+ * consider `/root/.local/bin` present because `/root/.local/bin/extra` is, and
+ * would then skip the prepend that makes the tool findable.
+ * @param {string} dir Directory to look for.
+ * @returns {boolean} True when PATH already contains exactly that entry.
+ */
+export function pathContains(dir, path = process.env.PATH ?? "") {
+  return path.split(delimiter).filter(Boolean).includes(dir);
+}
+
 /**
  * Run the project's own setup hook when it has one.
  *