@codyswann/lisa 2.333.3 → 2.334.1

package/all/copy-overwrite/scripts/lisa-hooks/sonar-secrets.sh

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+#
+# Shared wrapper around `sonar hook <event>` for every agent surface.
+#
+# `sonar integrate <agent>` generates a five-line shim per surface: if `sonar` is
+# on PATH, pipe the hook payload to it and let whatever comes back stand. That is
+# correct for the thing the scanner exists to do — refusing a prompt or a file
+# read that genuinely contains a credential — and wrong for the thing it also
+# does, which is refusing *everything* when the CLI has no token yet:
+#
+#   {"decision":"block","reason":"SonarQube secret scanning is inactive:
+#    not authenticated. Run 'sonar auth login'."}
+#
+# At the shim level that reply is indistinguishable from a real finding, so a
+# workstation that had simply never run the browser login could not submit a
+# prompt at all. Two things are wrong with that, and this wrapper fixes both.
+#
+# 1. The credential is usually already provisioned. A project that declares
+#    SONARQUBE_CLI_TOKEN under `secrets.require` has it in its configured
+#    provider — and the CLI reads only the environment and the OS keychain, so on
+#    a local surface (which deliberately materializes nothing to disk) the value
+#    is present and unreachable at the same time. We resolve it through
+#    lisa-secrets-access, the one sanctioned reader, and only when the CLI says
+#    it needs it.
+#
+# 2. An unauthenticated scanner is a degraded gate, not a breach. This hook is
+#    one of several overlapping layers: secret scanning at commit time and in CI
+#    does not depend on it. Blocking every prompt to protect a redundant layer
+#    trades a certain outage for a hypothetical leak — and the outage lands on
+#    exactly the person least able to diagnose it, since the block fires before
+#    their first prompt is ever seen.
+#
+# A real finding still blocks. Only the "inactive" reply is downgraded, and the
+# distinction is drawn on the reason text the vendor emits, so a detection that
+# arrives while unauthenticated is impossible by construction — in that state the
+# scanner does not scan at all.
+#
+# Usage: sonar-secrets.sh <vendor-event-name>   # hook payload on stdin
+set -uo pipefail
+
+event="${1:-}"
+[ -n "$event" ] || exit 0
+
+# Nothing installed, nothing to enforce. Matches the vendor shim's own guard.
+command -v sonar >/dev/null 2>&1 || exit 0
+
+# An explicit off switch, for bisecting a session that is misbehaving. There is
+# deliberately no way to turn the *blocking* back on from the environment: the
+# decision that a missing token must not stop work belongs in this file, where it
+# is reviewable, not in whatever shell happened to launch the agent.
+[ "${LISA_SONAR_HOOK:-on}" = "off" ] && exit 0
+
+payload="$(cat)"
+
+# The vendor signals its verdict as JSON on stdout and always exits 0, so the
+# exit code carries no information and the reason text is the only channel.
+inactive_marker='secret scanning is inactive'
+
+run_scanner() {
+  printf '%s' "$payload" | sonar hook "$event" 2>/dev/null
+}
+
+is_inactive() {
+  case "$1" in
+    *"$inactive_marker"*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# Run the resolver with a ceiling, because the provider call crosses the network
+# and this sits in front of every prompt and every file read. `timeout` is not
+# present on a stock macOS, so this is the portable equivalent: start it, poll,
+# give up. Giving up is safe — the caller treats an empty value as "the provider
+# had nothing", which lands on the warn path rather than a block.
+resolve_secret() {
+  local resolver="$1" name="$2" out pid waited=0
+  out="$(mktemp)" || return 0
+  node "$resolver" get "$name" >"$out" 2>/dev/null &
+  pid=$!
+  while kill -0 "$pid" 2>/dev/null; do
+    [ "$waited" -ge 10 ] && { kill -9 "$pid" 2>/dev/null; break; }
+    sleep 1
+    waited=$((waited + 1))
+  done
+  wait "$pid" 2>/dev/null
+  cat "$out"
+  rm -f "$out"
+}
+
+out="$(run_scanner)"
+
+if is_inactive "$out"; then
+  # Where lisa-secrets-access lives depends on how the project receives Lisa.
+  # Claude and Codex get it as an installed plugin, which is not part of a clone;
+  # the agent skill directories and node_modules are what a fresh checkout
+  # actually has. Same search order as the remote-env setup script, including the
+  # `plugins/` rung that exists only in the Lisa monorepo itself.
+  repo_root="${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+  resolver=""
+  for candidate in \
+    "$repo_root/.claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs" \
+    "$repo_root/.agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs" \
+    "$repo_root/.codex/skills/lisa-secrets-access/scripts/resolve-secret.mjs" \
+    "$repo_root/plugins/lisa/skills/lisa-secrets-access/scripts/resolve-secret.mjs" \
+    "$repo_root/node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-secrets-access/scripts/resolve-secret.mjs"; do
+    if [ -f "$candidate" ]; then
+      resolver="$candidate"
+      break
+    fi
+  done
+
+  if [ -n "$resolver" ] && command -v node >/dev/null 2>&1; then
+    token="$(resolve_secret "$resolver" SONARQUBE_CLI_TOKEN)"
+    if [ -n "$token" ]; then
+      # Exported into this process only. Writing it anywhere durable would create
+      # a second live copy of a credential whose single store is the provider —
+      # see the one-store rule in lisa-secrets-access.
+      export SONARQUBE_CLI_TOKEN="$token"
+      org="$(resolve_secret "$resolver" SONARQUBE_CLI_ORG)"
+      [ -n "$org" ] && export SONARQUBE_CLI_ORG="$org"
+      out="$(run_scanner)"
+    fi
+    unset token org
+  fi
+fi
+
+if is_inactive "$out"; then
+  # stderr on a zero exit is advisory in every agent's hook protocol: the user
+  # sees it, the operation proceeds.
+  echo "sonar: local secret scanning is inactive (no token in the environment," >&2
+  echo "  the OS keychain, or the configured secrets provider). Continuing —" >&2
+  echo "  commit-time and CI secret scanning still gate this repository." >&2
+  echo "  To restore it: 'sonar auth login', or store SONARQUBE_CLI_TOKEN in" >&2
+  echo "  the project's secrets provider." >&2
+  exit 0
+fi
+
+[ -n "$out" ] && printf '%s' "$out"
+exit 0

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA4pEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA2rNjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgqEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAmsNjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -9,6 +9,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh": "a6ed91576efebb6ba40cfa4e9d8a3e8566314909210ae8d5860be62a3feb4cff",
     "all/copy-overwrite/scripts/lisa-hooks/block-shell-json-parsing.sh": "3b5f074f3ab5708030af507eea962389f3b067c5dbdc76580bd9e44d3ac6c603",
     "all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh": "062c69eea85157f1e941ec3626d8912aa9f182af6ccdbe19687588a6074db5ce",
+    "all/copy-overwrite/scripts/lisa-hooks/sonar-secrets.sh": "7a408788975a6351d53e14aa32bb9a5d161f33df9dfea59ba32784ae33a62e67",
     "all/copy-overwrite/scripts/lisa-work-item.mjs": "6a8be8577242588f14ab52b25b2a22b6def53aefa9513b4d3d7c49f4d8027079",
     "all/create-only/.claude/rules/PROJECT_RULES.md": "6e1c7923ad2a15356babc60c97e7f97be728d790af285b6a7cd7d1b4d39cd97f",
     "all/create-only/.lisaignore": "3c9827e7e98daa46510b5357cd6dd9406da1821e64cc46d2eea9f311cd6d06b9",
@@ -312,6 +313,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/hooks/parity-safety-net.sh": "062c69eea85157f1e941ec3626d8912aa9f182af6ccdbe19687588a6074db5ce",
     "plugins/src/base/hooks/setup-jira-cli.sh": "a675f6b17ce7f0d6b9fb7daeba6d2bc59bcb48ef79b034076ea73b2b1e72ee09",
     "plugins/src/base/hooks/shell-write-nudge.sh": "69839af423f8792b1e52c71097316c3264425553031627c0a2f9409a9d5becd0",
+    "plugins/src/base/hooks/sonar-secrets.sh": "7a408788975a6351d53e14aa32bb9a5d161f33df9dfea59ba32784ae33a62e67",
     "plugins/src/base/hooks/threshold-ratchet-compare.mjs": "4535a145c5c5cbee13bdf970bc91d390a264043604e607288cdd6bf28de56192",
     "plugins/src/base/hooks/threshold-ratchet-families.mjs": "db14245ed89b483912af287bdee917a7a921dc21bb29b49be37fc799c05c413f",
     "plugins/src/base/hooks/threshold-ratchet.mjs": "04f660131bf50864239eb09cbf4d9555e53921254f6ab45ff2b85c173e160901",
@@ -553,7 +555,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-secrets-access/scripts/aws-bootstrap.mjs": "a06c212d45442a0a2daaefda1a7255e299f82704ca3637243b778d8268a5ce65",
     "plugins/src/base/skills/lisa-secrets-access/scripts/doctor-secrets.mjs": "f203c71457da958cdb49637c87e4a9c43e964f98ecef3dd0e933b419d565f98e",
     "plugins/src/base/skills/lisa-secrets-access/scripts/envfile.mjs": "be4e38ce85f9268b52b29dbde264ecd8d50973c2b63a15410336234a921d9644",
-    "plugins/src/base/skills/lisa-secrets-access/scripts/materialize-secrets.mjs": "0d214c16fa3e2d905e6ebd75c00710f9ec43449fd2337f2dca0b35833bb91f76",
+    "plugins/src/base/skills/lisa-secrets-access/scripts/materialize-secrets.mjs": "d74faf4f3d309f2bfb15c64386d2e28c811e958cd0d59fe24aa4b51e645a39ef",
     "plugins/src/base/skills/lisa-secrets-access/scripts/providers.mjs": "fec38ca937570c1e1c21e6e8f7314a9d8f4e9264779d0394b40d5158924da0da",
     "plugins/src/base/skills/lisa-secrets-access/scripts/read-secret-note.mjs": "1471d2108058f3059e242f9c71208c99fdbc212bde32de34b798eaa9a27ffbcc",
     "plugins/src/base/skills/lisa-secrets-access/scripts/resolve-secret.mjs": "04ab89bc1f890526ba3b693cd3b022abc5a24e078b93c08fe7dfd586452b70b1",
@@ -582,7 +584,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs": "aa703a3fcadd847594c694f458fc41edd39590dfabeddf4fed1546b73099f33f",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/toolchain.mjs": "496de5aed034692fee421dc3a1fbad9f85ed9e1d0c83a1080f781a486d0274e6",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs": "82bc2a27a0a5afb2ff413a88365c619fd7f0eaada5de3ccabf2000938f0607a4",
-    "plugins/src/base/skills/lisa-setup-sonar/SKILL.md": "53fbd8acce4b5e47e88195a7b90d5be424fa6ef7ad872f52c50467c690664c3b",
+    "plugins/src/base/skills/lisa-setup-sonar/SKILL.md": "b18e07ae942f75aad5730c0535840ef5f7115072f1b6cc62afac83196b28d6a3",
     "plugins/src/base/skills/lisa-setup-workstation/SKILL.md": "e57e64083c292f0402b704eeb647244be0f33ab17394a688bce57a1efd59f169",
     "plugins/src/base/skills/lisa-setup-workstation/scripts/catalogue.mjs": "eb0b8ec8a5d4fd81402dcbf40e6ccb55eb5e0c960f11aa928e45b99de43fabbc",
     "plugins/src/base/skills/lisa-setup-workstation/scripts/cli.mjs": "cb64e501a6e8bf0b12fd865aa0be3407f54c5a08537a36dc71d2ead4764f5da0",
@@ -970,7 +972,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "rails/deletions.json": "eeadf9a2b1677913199a235091a8d6190477f3e2a5fd598d62cf658cb59a8099",
     "rails/github-rulesets/quality-checks.json": "0ec1c366589edbaa6b8f45f940cef3ada5ed7b1a956d98d3fa6034b0f78fbc7c",
     "rails/merge/.claude/settings.json": "9c49f8c7c453f8749c90def3e22d412c3345c533d24b30dc7745ffa052ad6fa1",
-    "scripts/build-plugins.sh": "d4332a862d57798280e0d0c96826bbdc6b07855659dae529f8de32de994d2da9",
+    "scripts/build-plugins.sh": "c584fab4c77a77facf70c38c4699d4ed27d46ae667c1e1ef644efc2c4c5a14c7",
     "scripts/check-duplicate-versions.mjs": "84d97e94eb834522848ddce951bb54ae9da1e4be252e2c51fed0c01c4f4d6b72",
     "scripts/check-learnings-budget.ts": "007430c2d6938efcc79ccbfd5717ebe2c7cf66b4de9a21a3e67b8db7f3600349",
     "scripts/check-plugins-sync.sh": "3a99cbff0e8ec5e7c944690eae003a6d51b51c85436d77bd37faea4d553728af",
@@ -1257,6 +1259,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh": true,
     "all/copy-overwrite/scripts/lisa-hooks/block-shell-json-parsing.sh": true,
     "all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh": true,
+    "all/copy-overwrite/scripts/lisa-hooks/sonar-secrets.sh": true,
     "all/copy-overwrite/scripts/lisa-work-item.mjs": true,
     "all/create-only/.claude/rules/PROJECT_RULES.md": true,
     "all/create-only/.lisaignore": true,
@@ -2388,6 +2391,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-copilot/hooks/parity-safety-net.sh": true,
     "plugins/lisa-copilot/hooks/setup-jira-cli.sh": true,
     "plugins/lisa-copilot/hooks/shell-write-nudge.sh": true,
+    "plugins/lisa-copilot/hooks/sonar-secrets.sh": true,
     "plugins/lisa-copilot/hooks/threshold-ratchet-compare.mjs": true,
     "plugins/lisa-copilot/hooks/threshold-ratchet-families.mjs": true,
     "plugins/lisa-copilot/hooks/threshold-ratchet.mjs": true,
@@ -2802,6 +2806,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-cursor/hooks/parity-safety-net.sh": true,
     "plugins/lisa-cursor/hooks/setup-jira-cli.sh": true,
     "plugins/lisa-cursor/hooks/shell-write-nudge.sh": true,
+    "plugins/lisa-cursor/hooks/sonar-secrets.sh": true,
     "plugins/lisa-cursor/hooks/threshold-ratchet-compare.mjs": true,
     "plugins/lisa-cursor/hooks/threshold-ratchet-families.mjs": true,
     "plugins/lisa-cursor/hooks/threshold-ratchet.mjs": true,
@@ -5301,6 +5306,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa/hooks/parity-safety-net.sh": true,
     "plugins/lisa/hooks/setup-jira-cli.sh": true,
     "plugins/lisa/hooks/shell-write-nudge.sh": true,
+    "plugins/lisa/hooks/sonar-secrets.sh": true,
     "plugins/lisa/hooks/threshold-ratchet-compare.mjs": true,
     "plugins/lisa/hooks/threshold-ratchet-families.mjs": true,
     "plugins/lisa/hooks/threshold-ratchet.mjs": true,
@@ -5896,6 +5902,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/src/base/hooks/parity-safety-net.sh": true,
     "plugins/src/base/hooks/setup-jira-cli.sh": true,
     "plugins/src/base/hooks/shell-write-nudge.sh": true,
+    "plugins/src/base/hooks/sonar-secrets.sh": true,
     "plugins/src/base/hooks/threshold-ratchet-compare.mjs": true,
     "plugins/src/base/hooks/threshold-ratchet-families.mjs": true,
     "plugins/src/base/hooks/threshold-ratchet.mjs": true,
@@ -7313,6 +7320,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/hooks/parity-safety-net.test.ts": true,
     "tests/unit/hooks/post-checkout.test.ts": true,
     "tests/unit/hooks/pre-push-git-environment.test.ts": true,
+    "tests/unit/hooks/sonar-secrets.test.ts": true,
     "tests/unit/hooks/track-plan-sessions.test.ts": true,
     "tests/unit/hooks/typecheck-hook-placement.test.ts": true,
     "tests/unit/hooks/verification-failure-mode-fixtures.test.ts": true,
@@ -7384,6 +7392,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/scripts/work-item-tracker-unreachable.test.ts": true,
     "tests/unit/secrets/automation-workflow.test.ts": true,
     "tests/unit/secrets/aws-bootstrap-derivation.test.ts": true,
+    "tests/unit/secrets/aws-profile-collisions.test.ts": true,
     "tests/unit/secrets/aws-profiles-install.test.ts": true,
     "tests/unit/secrets/aws-profiles-permissions.test.ts": true,
     "tests/unit/secrets/aws-profiles.test.ts": true,
@@ -7392,6 +7401,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/secrets/detect-tooling.test.ts": true,
     "tests/unit/secrets/doctor-secrets.test.ts": true,
     "tests/unit/secrets/install-method-conformance.test.ts": true,
+    "tests/unit/secrets/local-aws-profiles.test.ts": true,
     "tests/unit/secrets/local-env-command.test.ts": true,
     "tests/unit/secrets/profile-sourcing.test.ts": true,
     "tests/unit/secrets/remote-dispatch-claude-web.test.ts": true,