@codyswann/lisa 2.328.3 → 2.328.5

package/plugins/lisa-agy/scripts/queue-contract-resolution.mjs

@@ -23,6 +23,15 @@ const DEFAULT_JIRA_BUILD_DONE = {
   production: "Done",
 };
 
+// Linear shares JIRA's env rung NAMES but is a separate constant on purpose:
+// the two vocabularies are independently configurable and a shared object would
+// silently couple them.
+const DEFAULT_LINEAR_BUILD_DONE = {
+  dev: "On Dev",
+  staging: "On Stg",
+  production: "Done",
+};
+
 const DEFAULT_GITHUB_LINEAR_PRD_ROLES = {
   draft: "prd-draft",
   ready: "prd-ready",
@@ -290,18 +299,21 @@ export function resolveBuildLifecycleRoles(
         },
       };
     case "linear":
+      // Linear resolves BUILD roles to native workflow states, like JIRA — not
+      // to labels like GitHub, which has no workflow-state field to use. The
+      // `kind` matters to callers: it tells them whether a transition is a
+      // state move or a label swap.
       return {
         vendor: "linear",
-        kind: "labels",
+        kind: "workflow",
         roles: {
-          ready: config.linear?.labels?.build?.ready || "status:ready",
-          claimed:
-            config.linear?.labels?.build?.claimed || "status:in-progress",
-          review: config.linear?.labels?.build?.review || "status:code-review",
-          blocked: config.linear?.labels?.build?.blocked || "status:blocked",
+          ready: config.linear?.workflow?.ready || "Ready",
+          claimed: config.linear?.workflow?.claimed || "In Progress",
+          review: config.linear?.workflow?.review || "In Review",
+          blocked: config.linear?.workflow?.blocked || "Blocked",
           done:
-            config.linear?.labels?.build?.done ||
-            structuredClone(DEFAULT_GITHUB_BUILD_DONE),
+            config.linear?.workflow?.done ||
+            structuredClone(DEFAULT_LINEAR_BUILD_DONE),
         },
       };
     case "jira":

package/plugins/lisa-agy/skills/lisa-detect-tooling/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lisa-detect-tooling
-description: "Find the command-line tools a project needs but never declares, and propose pinned manifest entries for them. Reads npm scripts, MCP servers, credential usage notes and quality configuration, subtracts whatever remoteEnv.tools already covers, and prints proposals with evidence. Writes nothing and installs nothing — a tool reaches a machine only when a human has reviewed a pinned, checksummed entry. Invoked by lisa-setup-remote-env before provisioning, and runnable on its own."
+description: "Find the command-line tools a project needs but never declares, and propose pinned manifest entries for them. Reads git hooks and npm scripts for what the project actually RUNS — discovering tools no list mentions — plus MCP servers, credential usage notes and quality configuration. Subtracts whatever remoteEnv.tools, node_modules and the workstation layer already cover, and prints proposals with evidence. Writes nothing and installs nothing — a tool reaches a machine only when a human has reviewed a pinned, checksummed entry. Invoked by lisa-setup-remote-env before provisioning, and runnable on its own."
 allowed-tools: ["Bash", "Read", "AskUserQuestion"]
 ---
 
@@ -20,15 +20,45 @@ Nothing populates that last row. So a project can ship scripts that invoke `maes
 
 That is the same failure this repository has now paid for twice: `gh` was declared nowhere and a cloud session could not commit; `tar` was needed by an install method and asserted by nothing.
 
+## Discovery, not recognition
+
+The first version of this could only find tools it had been told about: it matched script bodies against a fixed `KNOWN_TOOLS` list. That makes the detector useful for exactly the set that needs it least — the tools someone already thought of.
+
+An Expo project invoking `eas` from **eight** npm scripts and six CI steps produced no proposal, because `eas` was not on the list. `gitleaks`, which runs on every commit in every one of these repositories, produced no proposal either.
+
+So the question asked of executable sources is now the open one — *what does this project actually run* — and everything already provided is subtracted afterwards:
+
+- what `remoteEnv.tools` declares
+- what `node_modules/.bin` provides (a dependency's binary never needs to be on PATH)
+- what `lisa-setup-workstation` owns (coding agents belong to the machine, not the checkout)
+
+The curated list stays, because a vetted `why` is worth more than an observed one — proposals say which they are, `[curated]` or `[discovered]`.
+
 ## What it does
 
-Reads four signals, subtracts what `remoteEnv.tools` already declares, and prints what is left with the evidence for each:
+Reads six signals, subtracts what is already covered, and prints what is left with the evidence for each:
+
+- **git hooks** (`.husky/*`, `.git/hooks/*`) that invoke a binary. The **strongest** signal available, stronger than an npm script: a hook runs on every commit and push whether anyone asked or not, so a machine without the tool cannot commit at all.
 
-- **npm scripts** that invoke a binary. The strongest signal there is — a script running `maestro test` is the project stating a dependency in executable form. Matched on the script *body*, not its name, because the name is a label.
+  A `command -v` guard counts as evidence rather than as "optional", because the guarded shape is the worse one. Lisa's pre-commit hook wraps its secret scan in `command -v gitleaks`, so on a machine without gitleaks the scan is **skipped silently** — the hook passes, the commit succeeds, and nothing was scanned. A guard makes the absence invisible precisely where it matters.
+
+- **npm scripts** that invoke a binary — a script running `maestro test` is the project stating a dependency in executable form. Read from the script *body*, not its name, because the name is a label.
 - **MCP servers with a CLI equivalent.** An MCP server is not a substitute for the binary: several authenticate by browser OAuth, which a container cannot do, so a project relying on one remotely has *no* integration rather than a degraded one. Do not infer a CLI for access layers that already define their own headless substrate; Linear is handled by `lisa-linear-access` through `LINEAR_API_KEY` + GraphQL when MCP OAuth is unavailable.
 - **Credential usage notes.** A note explaining what a token is for usually names the program that consumes it. `lisa-secrets-access` already exposes these without touching a value, which makes them a first-class input rather than a trick.
 - **Quality configuration**, where a threshold implies the tool that produces it.
 
+## Reading shell is the hard part
+
+Discovery only works if "what does this run" can be answered from shell text without inventing commands. Three things had to be right, each found by running it against real repositories:
+
+**Only the first word of a command position counts.** Word-scanning this repo's own hooks proposed `ltrimstr`, `map` and `select` (jq filter internals), `console.log` and `process.exit` (embedded JavaScript), and `load_audit_cves` (a function the hook defines three lines up). Reading only where a command can actually start removes all of them without a denylist entry for any.
+
+**Quoting and commenting nest, so neither can be stripped independently.** The comment on line 9 of `pre-push.local` ends `...the script's exit code)`. That lone apostrophe pairs with the next real quote 28 lines later, blanks everything between, and leaks a `node -e` payload's JavaScript into the results. Stripping comments first does not fix it, because a `#` inside a quoted string is not a comment. One character scanner tracking both is the only correct shape.
+
+**`$( )` restarts the quoting context.** In `"$(printf '%s' "$JSON" | node -e '…')"`, quotes inside the substitution pair among themselves. A flat scanner falls out of phase on the first one and starts reporting the payload's own string literals.
+
+Against Lisa and the three TunnlAI repositories, what survives is `gitleaks`, `jq`, `gtimeout` and `eas` — every one a real, undeclared invocation, with no false positives.
+
 ## What it will not do
 
 **It writes nothing and installs nothing.** Output is a proposal with `<pin>`, `<release url>` and `<sha256>` left for a human.

package/plugins/lisa-agy/skills/lisa-detect-tooling/scripts/commands.mjs

@@ -0,0 +1,479 @@
+/**
+ * Pull the commands out of a shell body.
+ *
+ * `lisa-detect-tooling` used to match script bodies against a fixed list of tool
+ * names, which meant it could only ever re-find tools someone had already
+ * thought of — the set that needs a detector least. An Expo project invoking
+ * `eas` from eight npm scripts produced nothing, because `eas` was not in the
+ * list.
+ *
+ * So the question this module answers is the open one: what does this shell text
+ * actually RUN? Everything downstream then subtracts what is already provided.
+ *
+ * ## Only the first word of a command position
+ *
+ * Naive word-scanning of this repository's own hooks proposed `ltrimstr`, `map`
+ * and `select` (jq filter internals), `console.log` and `process.exit` (embedded
+ * JavaScript), and `load_audit_cves` (a function the hook defines three lines
+ * up). None of those are tools; all of them appear where a word-scanner looks.
+ *
+ * A command runs at a command POSITION — the start of the text, or just after a
+ * separator. Reading only that position removes every one of those false
+ * positives without a denylist entry for any of them.
+ * @module commands
+ */
+
+/**
+ * Shell keywords and coreutils: present on any machine, never provisioned.
+ *
+ * This is a floor, not a policy. Anything genuinely absent from a minimal
+ * container belongs in the manifest, and a few of these (`unzip`, `curl`) are
+ * already declared there by projects that need them — being listed here only
+ * means discovery will not RAISE them, not that they are assumed present.
+ */
+export const SHELL_VOCABULARY = new Set([
+  // Keywords and builtins.
+  "if",
+  "then",
+  "else",
+  "elif",
+  "fi",
+  "for",
+  "while",
+  "until",
+  "do",
+  "done",
+  "case",
+  "esac",
+  "in",
+  "function",
+  "return",
+  "break",
+  "continue",
+  "exit",
+  "local",
+  "readonly",
+  "declare",
+  "export",
+  "unset",
+  "shift",
+  "eval",
+  "exec",
+  "source",
+  "set",
+  "trap",
+  "wait",
+  "read",
+  "echo",
+  "printf",
+  "cd",
+  "pwd",
+  "true",
+  "false",
+  "test",
+  "let",
+  "alias",
+  "shopt",
+  "getopts",
+  "umask",
+  // Coreutils and the usual POSIX furniture.
+  "cat",
+  "grep",
+  "egrep",
+  "fgrep",
+  "sed",
+  "awk",
+  "cut",
+  "tr",
+  "sort",
+  "uniq",
+  "head",
+  "tail",
+  "wc",
+  "tee",
+  "xargs",
+  "find",
+  "ls",
+  "mkdir",
+  "rmdir",
+  "rm",
+  "mv",
+  "cp",
+  "ln",
+  "touch",
+  "chmod",
+  "chown",
+  "stat",
+  "du",
+  "df",
+  "dirname",
+  "basename",
+  "realpath",
+  "readlink",
+  "mktemp",
+  "date",
+  "sleep",
+  "seq",
+  "env",
+  "kill",
+  "pgrep",
+  "pkill",
+  "ps",
+  "diff",
+  "comm",
+  "join",
+  "paste",
+  "split",
+  "tar",
+  "gzip",
+  "gunzip",
+  "zip",
+  "unzip",
+  "curl",
+  "wget",
+  "sh",
+  "bash",
+  "zsh",
+  "dash",
+  "nohup",
+  "timeout",
+  "yes",
+  "tty",
+  "id",
+  "whoami",
+  "uname",
+  "hostname",
+]);
+
+/**
+ * Runtimes and package managers whose presence is assumed by everything here.
+ *
+ * Separate from the vocabulary above because these are genuinely provisioned —
+ * just not by this detector. `node` is what runs it; proposing it would be
+ * circular.
+ */
+export const RUNTIMES = new Set([
+  "node",
+  "npm",
+  "npx",
+  "bun",
+  "bunx",
+  "yarn",
+  "pnpm",
+  "pnpx",
+  "corepack",
+  "git",
+  "python",
+  "python3",
+  "pip",
+  "pip3",
+  "ruby",
+  "bundle",
+  "go",
+  "cargo",
+  "docker",
+  "make",
+]);
+
+/**
+ * Commands that RESOLVE the next word from `node_modules`.
+ *
+ * `npx playwright test` needs no manifest entry: npm put the binary in
+ * `node_modules/.bin` and npx finds it there. Reading the mediated word as a
+ * tool would propose pinning something the package manager already provides —
+ * the noise that teaches a reader to skim the output.
+ */
+const MEDIATORS = new Set(["npx", "bunx", "pnpx", "dlx"]);
+
+/** Sub-commands after a package manager that mean "run something local". */
+const LOCAL_RUNNERS = new Set(["run", "exec", "x", "dlx", "run-script"]);
+
+/**
+ * Commands that TEST for another command rather than running it.
+ *
+ * `command -v gitleaks` is the single most valuable signal a hook can carry, and
+ * a word-scanner reading only the first position would throw it away. It is also
+ * the shape of the worst failure mode in this codebase: a hook that guards its
+ * own tool with `command -v` SKIPS SILENTLY when the tool is absent. The commit
+ * succeeds and nothing was scanned.
+ *
+ * A guarded tool is therefore stronger evidence than an unguarded one, not
+ * weaker — its absence is invisible at the moment it matters.
+ */
+const PROBES = new Set(["command", "which", "type", "hash"]);
+
+/**
+ * Words that stand in FRONT of a command without being one.
+ *
+ * Control keywords have to be skipped past rather than treated as the command,
+ * or the very shape this exists to catch is missed: in
+ * `if ! command -v gitleaks; then`, stopping at `if` never reaches the probe.
+ */
+const PREFIXES = new Set([
+  "!",
+  "sudo",
+  "time",
+  "nice",
+  "builtin",
+  "exec",
+  "if",
+  "then",
+  "elif",
+  "else",
+  "while",
+  "until",
+  "do",
+]);
+
+/** A name that could plausibly be an executable on PATH. */
+const TOOL_NAME = /^[a-z][a-z0-9_-]*$/u;
+
+/**
+ * Names the text defines as shell functions, which are never PATH tools.
+ *
+ * This repository's `pre-push` hook defines `load_audit_cves` and
+ * `missing_opencode_metadata` and then calls them, which reads exactly like a
+ * command invocation because it is one — just not of anything installable.
+ * @param {string} text Shell body.
+ * @returns {Set<string>} Locally defined function names.
+ */
+export function localFunctions(text) {
+  const names = new Set();
+  const pattern =
+    /(?:^|\n)\s*(?:function\s+)?([a-z_][a-z0-9_]*)\s*\(\)\s*\{/giu;
+  let match = pattern.exec(text);
+  while (match) {
+    names.add(match[1].toLowerCase());
+    match = pattern.exec(text);
+  }
+  return names;
+}
+
+/**
+ * Pull out `sh -c '...'` payloads so their contents are parsed as shell too.
+ *
+ * Done BEFORE quoted spans are stripped, because the payload is precisely a
+ * quoted span — and it is the one kind that really is a command. Frontend's
+ * `eas:publish:e2e` script wraps its `eas update` in exactly this shape.
+ * @param {string} text Shell body.
+ * @returns {{stripped: string, payloads: string[]}} Text and nested bodies.
+ */
+export function extractShellPayloads(text) {
+  const payloads = [];
+  const stripped = text.replace(
+    /\b(?:sh|bash|zsh)\s+-[a-z]*c\s+('([^']*)'|"([^"]*)")/gu,
+    (_all, _quoted, single, double) => {
+      payloads.push(single ?? double ?? "");
+      return " ";
+    }
+  );
+  return { stripped, payloads };
+}
+
+/**
+ * Blank out quoted spans and comments, keeping only text at command level.
+ *
+ * Quoted text is where embedded programs live — the jq filters and `node -e`
+ * snippets that produced `ltrimstr` and `console.log`. A command inside quotes
+ * is an argument to something else, with one exception, which
+ * `extractShellPayloads` has already lifted out by the time this runs.
+ *
+ * This is a character scanner rather than a chain of regexes because quoting and
+ * commenting are MUTUALLY nested and no ordering of independent passes gets it
+ * right. This repository's own `pre-push.local` proves it: the comment on line 9
+ * ends `...the script's exit code)`, and that lone apostrophe pairs with the
+ * next real quote 28 lines later, blanking everything between — including the
+ * `node -e` payload, whose JavaScript then leaked out as `try`, `catch`,
+ * `const` and `unreadable` proposals.
+ *
+ * Stripping comments first does not fix it either, since a `#` inside a quoted
+ * string is not a comment. One pass that tracks both is the only correct shape.
+ *
+ * Newlines survive so command positions are preserved; everything else inside a
+ * masked span becomes a space.
+ * @param {string} text Shell body.
+ * @returns {string} Text with non-command spans blanked.
+ */
+export function stripNonCommandSpans(text) {
+  const out = [];
+  let state = "normal";
+  // `$( )` restarts the quoting context: inside it, quotes pair among
+  // themselves rather than continuing the enclosing span. A flat scanner falls
+  // out of phase on the very first one — this repository's
+  // `"$(printf '%s' "$JSON" | node -e '...')"` left the payload's own string
+  // literals exposed at command level, proposing `data`, `end` and `stale`.
+  const enclosing = [];
+
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    const previous = index > 0 ? text[index - 1] : "";
+
+    // A substitution opens a fresh context from inside ANY state but a
+    // single-quoted one, where shell performs no substitution at all.
+    if (
+      state !== "single" &&
+      state !== "comment" &&
+      char === "$" &&
+      text[index + 1] === "("
+    ) {
+      enclosing.push(state);
+      state = "normal";
+      out.push("\n");
+      index += 1;
+      continue;
+    }
+    if (state === "normal" && char === ")" && enclosing.length > 0) {
+      state = enclosing.pop();
+      out.push("\n");
+      continue;
+    }
+
+    if (state === "normal") {
+      if (char === "\\") {
+        // An escaped character is never a delimiter. Skip both.
+        out.push(" ");
+        index += 1;
+        if (text[index] === "\n") out.push("\n");
+        else out.push(" ");
+        continue;
+      }
+      if (char === "'") {
+        state = "single";
+        out.push(" ");
+        continue;
+      }
+      if (char === '"') {
+        state = "double";
+        out.push(" ");
+        continue;
+      }
+      // A `#` only opens a comment at the start of a word.
+      if (char === "#" && (previous === "" || /\s/u.test(previous))) {
+        state = "comment";
+        out.push(" ");
+        continue;
+      }
+      out.push(char);
+      continue;
+    }
+
+    if (state === "comment") {
+      if (char === "\n") {
+        state = "normal";
+        out.push("\n");
+        continue;
+      }
+      out.push(" ");
+      continue;
+    }
+
+    // Inside quotes. A single-quoted span has no escapes at all in shell.
+    if (state === "double" && char === "\\") {
+      out.push(" ");
+      index += 1;
+      out.push(text[index] === "\n" ? "\n" : " ");
+      continue;
+    }
+    if (
+      (state === "single" && char === "'") ||
+      (state === "double" && char === '"')
+    ) {
+      state = "normal";
+      out.push(" ");
+      continue;
+    }
+    out.push(char === "\n" ? "\n" : " ");
+  }
+
+  // Redirections last, on text that is already command-level.
+  return out.join("").replace(/\d?[<>]+&?\S*/gu, " ");
+}
+
+/**
+ * Whether a word can be a tool this detector should raise.
+ *
+ * One gate, applied to every path into the results. Probed names used to skip
+ * it, which is how `command -v bun` — a hook checking its own runtime — became
+ * a proposal to pin bun on every repository scanned.
+ * @param {string} word Candidate command name.
+ * @param {Set<string>} defined Function names the text defines itself.
+ * @returns {boolean} Whether to raise it.
+ */
+function admissible(word, defined) {
+  // A path is not a PATH lookup: `./scripts/check.sh` is project code.
+  if (word.includes("/") || word.includes("$")) return false;
+  if (!TOOL_NAME.test(word)) return false;
+  if (SHELL_VOCABULARY.has(word)) return false;
+  // `bun run build` resolves locally, and the runtime itself is assumed.
+  if (RUNTIMES.has(word)) return false;
+  return !defined.has(word);
+}
+
+/**
+ * Read the tool a probe is testing for.
+ * @param {string[]} words Words after the probe.
+ * @returns {string|null} The probed name, or null.
+ */
+function probedTool(words) {
+  for (const word of words) {
+    if (word.startsWith("-")) continue;
+    return TOOL_NAME.test(word) ? word : null;
+  }
+  return null;
+}
+
+/**
+ * Every command this shell text runs, at a command position.
+ * @param {string} text Shell body.
+ * @returns {string[]} Command names, deduplicated, in first-seen order.
+ */
+export function commandsIn(text) {
+  if (typeof text !== "string" || text.trim() === "") return [];
+
+  const { stripped, payloads } = extractShellPayloads(text);
+  const defined = localFunctions(text);
+  const found = new Set();
+
+  // Nested `sh -c` bodies are shell in their own right, so they get the same
+  // treatment rather than a weaker one.
+  for (const payload of payloads) {
+    for (const command of commandsIn(payload)) found.add(command);
+  }
+
+  const segments = stripNonCommandSpans(stripped).split(
+    /\|\||&&|\$\(|[;|&\n(){}`]/u
+  );
+
+  for (const segment of segments) {
+    const words = segment.trim().split(/\s+/u).filter(Boolean);
+    let index = 0;
+    // Environment assignments and decorations sit in front of the command.
+    while (
+      index < words.length &&
+      (/^[A-Za-z_][A-Za-z0-9_]*=/u.test(words[index]) ||
+        PREFIXES.has(words[index]))
+    ) {
+      index += 1;
+    }
+
+    const word = words[index]?.toLowerCase();
+    if (!word) continue;
+
+    if (PROBES.has(word)) {
+      // `command -v gitleaks` — the probed name is the evidence. It goes
+      // through the SAME filters as a directly invoked command: reading it
+      // straight into the results proposed `bun` and `yarn` on every repo,
+      // because `command -v bun` is how a hook checks its own runtime.
+      const probed = probedTool(words.slice(index + 1));
+      if (probed && admissible(probed, defined)) found.add(probed);
+      continue;
+    }
+    if (MEDIATORS.has(word)) continue;
+    if (LOCAL_RUNNERS.has(word)) continue;
+    if (!admissible(word, defined)) continue;
+
+    found.add(word);
+  }
+
+  return [...found];
+}