@codyswann/lisa 3.14.8 → 3.15.1

package/expo/copy-overwrite/scripts/bdd/markdown-cell.mjs

@@ -0,0 +1,128 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/**
+ * Markdown table-cell escaping, shared by the BDD burndown renderer and the
+ * Maestro failure classifier.
+ *
+ * Waiver reasons, scenario titles, discovered test names and Maestro failure
+ * messages are repo data that lands inside a generated Markdown table. A single
+ * `|` ends the cell early and shifts every column after it, so the columns to
+ * its right silently misreport — in a generated file nobody re-reads. A line
+ * ending is worse: it ends the ROW, so one record becomes two and every column
+ * after the break is read against the wrong header.
+ *
+ * This module exists because the escaper was module-private and DUPLICATED —
+ * `cell` inside `scripts/bdd/render.mjs` and `escapeCell` inside
+ * `scripts/classify-maestro-failures.mjs`. Neither copy could be reached by a
+ * unit test, so both could only be exercised indirectly through a whole
+ * rendered document, and the two had already drifted: one stripped `\r\n` and
+ * `\n`, the other only `\n`. Both leaked live column separators.
+ *
+ * The contract predicates below are exported alongside it deliberately, so
+ * "table safe" has one definition rather than one per test. That is worth
+ * having and it is NOT sufficient: the first fix on this defect shipped with
+ * `hasUnescapedPipe` already asserting the right answer for `\\|` while `cell`
+ * was never fed that input, so the escaper leaked at every even backslash run
+ * with the yardstick sitting right there, correct and unused. A shared
+ * predicate only helps once something SWEEPS the subject with it. Enumerate the
+ * property; the named instances are documentation.
+ *
+ * @module scripts/bdd/markdown-cell
+ */
+
+/**
+ * Escape one pipe together with the WHOLE backslash run in front of it.
+ *
+ * The rule is the same one {@link hasUnescapedPipe} measures, stated once:
+ * a pipe is a live column separator exactly when an EVEN number of backslashes
+ * (zero included) precedes it. So an even run needs one more backslash; an odd
+ * run is already an escape and must be left alone, or the escaper would grow
+ * the run on every pass and stop being idempotent.
+ *
+ * Two nearby spellings are wrong and both look right:
+ *
+ *  - `/\\?\|/` — consumes at most ONE preceding backslash, so `\\|` (escaped
+ *    backslash, live pipe) is seen as an escape that is already present and is
+ *    passed through untouched. It leaks at every even run: measured live at
+ *    runs 2, 4, 6 and 8. That was this defect's first fix and was itself a bug —
+ *    the report named two INSTANCES, and fixing those is not fixing the
+ *    property.
+ *  - `/((?:\\\\)*)\|/` with a `"$1\\|"` replacement — an even-run pattern with
+ *    no left anchor. The engine simply slides one character right and matches
+ *    an even run INSIDE an odd one, so `\|` becomes `\\\|`. Measured: 60 leaks
+ *    over the same sweep. A `(?<!\\)` lookbehind fixes it, but the arithmetic
+ *    below says the same thing without needing that argument.
+ *
+ * @param {string} _match - The whole match; unused.
+ * @param {string} backslashes - The backslash run preceding the pipe.
+ * @returns {string} The run, escaped, plus the pipe.
+ */
+const escapePipeRun = (_match, backslashes) =>
+  `${backslashes}${backslashes.length % 2 === 0 ? "\\" : ""}|`;
+
+/**
+ * Make author-supplied text safe inside a Markdown table cell.
+ *
+ * Both steps exist because the obvious spelling of each was wrong, and both
+ * failures are invisible in review:
+ *
+ *  - Pipes are escaped by RUN, not one at a time — see {@link escapePipeRun}.
+ *  - `/\r\n?|\n/` and not `/\r?\n/`. The latter only matches a CR that is
+ *    FOLLOWED by an LF, so a lone `\r` survives — and CommonMark treats a lone
+ *    CR as a line ending, which ends the row rather than the cell.
+ *
+ * The `?? ""` guard is load-bearing and must stay: without it a nullish waiver
+ * field prints the literal text "null" or "undefined" into the ledger, which
+ * reads as data.
+ *
+ * SCOPE — this is SAFETY, not FIDELITY, and the difference is deliberate. The
+ * only promise made is that no live column separator and no line ending reach
+ * the table; it is NOT promised that a reader can recover the input byte for
+ * byte. Lone backslashes are left exactly as they arrive, so Markdown consumes
+ * them pairwise and a cell holding N backslashes DISPLAYS `floor(N / 2)` of
+ * them. A round-trip-safe escaper is one step longer —
+ * `.replace(/\\/g, "\\\\").replace(/\|/g, "\\|")` — and was not chosen: it
+ * rewrites every backslash in every waiver reason and scenario title in the
+ * repo, which churns the generated ledger for a fidelity nobody consumes, and
+ * it is not what {@link hasUnescapedPipe} measures. If a caller ever needs the
+ * input back out of the table, it needs that escaper and a matching
+ * unescaper — not a patch to this one.
+ * @param {unknown} text - Arbitrary cell content.
+ * @returns {string} Text safe to interpolate into a table row.
+ */
+export const cell = text =>
+  String(text ?? "")
+    .replace(/(\\*)\|/g, escapePipeRun)
+    .replace(/\r\n?|\n/g, " ");
+
+/**
+ * Whether `text` still carries a line ending. A cell containing one splits the
+ * table row it sits in, so this is the second half of the safety contract.
+ * @param {string} text - Text already passed through {@link cell}.
+ * @returns {boolean} True when a CR or an LF survives.
+ */
+export const hasLineEnding = text => /[\r\n]/.test(String(text));
+
+/**
+ * Whether `text` still carries a pipe that Markdown will read as a column
+ * separator.
+ *
+ * A pipe is escaped only when an ODD number of backslashes precedes it: `\|` is
+ * a literal pipe, but `\\|` is an escaped backslash followed by a LIVE pipe.
+ * That distinction is the whole reason this predicate is not a regex.
+ * @param {string} text - Text already passed through {@link cell}.
+ * @returns {boolean} True when a column-separating pipe survives.
+ */
+export const hasUnescapedPipe = text => {
+  let backslashes = 0;
+  for (const character of String(text)) {
+    if (character === "\\") {
+      backslashes += 1;
+      continue;
+    }
+    if (character === "|" && backslashes % 2 === 0) return true;
+    backslashes = 0;
+  }
+  return false;
+};

package/expo/copy-overwrite/scripts/bdd/render.mjs

@@ -11,6 +11,7 @@
  * @module scripts/bdd/render
  */
 import { byCodeUnit } from "./contract.mjs";
+import { cell } from "./markdown-cell.mjs";
 
 /**
  * Format a coverage figure, refusing to print "100%" for an empty
@@ -25,20 +26,6 @@ const fmt = value =>
     ? "n/a (no obligations)"
     : `${value.covered}/${value.total} (${value.percentage.toFixed(1)}%)`;
 
-/**
- * Make author-supplied text safe inside a Markdown table cell.
- *
- * Waiver reasons and scenario titles are repo data. A single `|` ends the
- * cell early and shifts every column after it, so the Ticket and Expires
- * columns silently misreport — in a generated file nobody re-reads.
- * @param {unknown} text - Arbitrary cell content.
- * @returns {string} Text safe to interpolate into a table row.
- */
-const cell = text =>
-  String(text ?? "")
-    .replace(/\|/g, "\\|")
-    .replace(/\r?\n/g, " ");
-
 /**
  * Render the per-platform traceability table.
  * @param {object} report - The coverage report.

package/expo/copy-overwrite/scripts/bdd-matrix.mjs

@@ -21,12 +21,13 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 
 import { byCodeUnit, declaredPlatforms, trackerUrl } from "./bdd/contract.mjs";
 import { loadScenarios } from "./bdd/parse.mjs";
 import { indexResults } from "./bdd/report.mjs";
 import { loadExecutionResults } from "./check-bdd-coverage.mjs";
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 const PACKAGE_ROOT = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
@@ -250,5 +251,4 @@ function main() {
   console.log(`[bdd-matrix] wrote ${OUT_REL}`);
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
-  main();
+if (invokedAsScript(import.meta.url)) main();

package/expo/copy-overwrite/scripts/check-bdd-coverage.mjs

@@ -43,7 +43,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 
 import {
   ADOPTION_STATES,
@@ -81,6 +81,7 @@ import {
   validateTrackerTags,
 } from "./bdd/validate.mjs";
 import { ISO_DATE, validateWaivers } from "./bdd/waivers.mjs";
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 const PACKAGE_ROOT = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
@@ -796,5 +797,4 @@ function printHuman(gateRun, envelope) {
   console.error(`[bdd-coverage] ${envelope.summary.headline}`);
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
-  main();
+if (invokedAsScript(import.meta.url)) main();

package/expo/copy-overwrite/scripts/check-e2e-coverage.mjs

@@ -32,7 +32,8 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { pathToFileURL } from "node:url";
+
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 export const defaultThresholds = {
   playwright: { routes: 80 },
@@ -389,9 +390,6 @@ function main() {
 }
 
 // Run only when invoked directly — importing for tests must have no side effects.
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
+if (invokedAsScript(import.meta.url)) {
   main();
 }

package/expo/copy-overwrite/scripts/classify-maestro-failures.mjs

@@ -104,7 +104,9 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { pathToFileURL } from "node:url";
+
+import { cell } from "./bdd/markdown-cell.mjs";
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 /**
  * Wait commands whose `timeout:` is a ceiling the command burns before failing.
@@ -667,7 +669,7 @@ export function renderMarkdown({ report, failures, defects }) {
         ? `${failure.intermittent.ratePercent}% (${failure.intermittent.failures}/${failure.intermittent.runs}, measured ${failure.intermittent.measuredAt})`
         : "—";
       lines.push(
-        `| \`${failure.flow}\` | ${escapeCell(failure.message)} | ${known} |`
+        `| \`${failure.flow}\` | ${cell(failure.message)} | ${known} |`
       );
     }
     lines.push("");
@@ -696,15 +698,6 @@ export function renderMarkdown({ report, failures, defects }) {
   return lines.join("\n");
 }
 
-/**
- * Escape a value so it cannot break out of a markdown table cell.
- * @param {string} value - Raw text
- * @returns {string} Escaped text
- */
-function escapeCell(value) {
-  return String(value).replace(/\|/g, "\\|").replace(/\n/g, " ");
-}
-
 /**
  * Render one report's classification as plain text.
  * @param {{report: string, failures: object[], defects: object[]}} result - One report's result
@@ -770,9 +763,6 @@ function main(argv) {
   }
 }
 
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
+if (invokedAsScript(import.meta.url)) {
   main(process.argv.slice(2));
 }

package/expo/copy-overwrite/scripts/lib/invoked-as-script.mjs

@@ -0,0 +1,96 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/**
+ * invoked-as-script — the one implementation of "was this module run as the CLI
+ * entry point?", shared by every guarded `.mjs` entry point Lisa ships.
+ *
+ * @remarks
+ * ## Why this is shared rather than copied
+ *
+ * The obvious spelling is `import.meta.url === pathToFileURL(process.argv[1]).href`,
+ * and it is wrong in a way that cannot be seen in review. `import.meta.url` is
+ * normally the REAL path — node resolves ESM through `realpath` unless
+ * `--preserve-symlinks` or `--preserve-symlinks-main` is set — while `argv[1]`
+ * is whatever spelling the caller typed. Naming only the first of those two
+ * flags is what let a second instance of this very defect survive review here:
+ * `--preserve-symlinks-main` is a SEPARATE flag that applies to the entry
+ * module specifically, which is exactly the module this guard runs in, so it is
+ * the one that matters most and the one easiest to leave out. See the section
+ * on realpathing both sides below.
+ * Reached through a symlinked checkout, a symlinked bin shim, or a
+ * `/tmp` path on macOS (`/tmp` is itself a symlink to `/private/tmp`), the two
+ * differ, the guard is false, `main()` never runs, and the process exits 0
+ * having done nothing.
+ *
+ * That failure mode is not symmetric. A no-op GENERATOR usually fails closed —
+ * whatever consumes its output notices the missing artifact. A no-op CHECK
+ * fails **OPEN**: it prints nothing, exits 0, and the npm script "succeeds", so
+ * a gate that is meant to block a merge silently stops having an opinion. Every
+ * `check-*.mjs` in this tree is in the second category, and git worktrees —
+ * which every Lisa-driven agent uses — put a symlinked path on that code path
+ * as a matter of routine.
+ *
+ * ## `moduleUrl` is REQUIRED, and is the FIRST parameter
+ *
+ * A deliberate deviation from the obvious signature
+ * `invokedAsScript(argv1 = process.argv[1], moduleUrl = import.meta.url)`. A
+ * defaulted `import.meta.url` inside a SHARED module resolves to *this* file,
+ * which is never anybody's `process.argv[1]` — so a caller that forgot the
+ * second argument would get `false` forever and no-op silently. That is exactly
+ * the fail-open defect this module exists to remove, re-introduced by its own
+ * convenience default. Making it required and first means a call site cannot be
+ * written wrong.
+ *
+ * ## Why ANY resolution error returns false
+ *
+ * `realpathSync` throws ENOENT, EACCES, ELOOP and ENOTDIR, not just ENOENT. A
+ * fallback that narrows to ENOENT and then compares `resolve(argv1)` reinstates
+ * the un-normalized comparison the realpath exists to avoid, so the symlink
+ * defect survives on precisely the path meant to be the safety net.
+ *
+ * Returning `false` on an unresolvable `argv[1]` is sound rather than merely
+ * convenient: node resolved and LOADED the entry point from that path moments
+ * earlier, so a path that cannot be resolved now is not the path this module
+ * was loaded through. Comparing an unnormalized spelling instead would answer
+ * "maybe" with a confident "yes".
+ *
+ * ## Why BOTH sides are realpath'd, not just `argv[1]`
+ *
+ * "`import.meta.url` is always the real path" is true by default and false under
+ * `--preserve-symlinks-main`, which tells node not to resolve the main entry.
+ * Normalizing only `argv[1]` then compares a real path against a symlinked one
+ * and answers `false` for an entry point that WAS invoked directly — the same
+ * fail-open this module exists to remove, reappearing on the flag that most
+ * looks like it should not matter. Measured: a symlinked entry point reports
+ * `true` normally and `false` under the flag.
+ *
+ * Realpathing both sides is free in the ordinary case, where `moduleUrl` is
+ * already canonical and `realpathSync` is the identity.
+ *
+ * @module scripts/lib/invoked-as-script
+ */
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+/**
+ * True when `moduleUrl` names the module node was asked to run.
+ *
+ * Both sides are realpath'd before comparison — see the module remarks for why a
+ * raw comparison silently answers "no" under a symlinked path, and why
+ * normalizing only `argv[1]` leaves the same hole open under
+ * `--preserve-symlinks-main`.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+export function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  // `node -e`, `node --eval`, `node --print` and the REPL leave `argv[1]`
+  // undefined. Nothing was asked to run, so nothing should.
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}

package/package.json

@@ -125,7 +125,7 @@
     }
   },
   "name": "@codyswann/lisa",
-  "version": "3.14.8",
+  "version": "3.15.1",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.14.8",
+  "version": "3.15.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.14.8",
+  "version": "3.15.1",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/SKILL.md

@@ -83,6 +83,7 @@ ${XDG_CONFIG_HOME:-$HOME/.config}/<secrets.namespace>/     # dir 0700
     "namespace": "myproject",
     "require": ["ATTIO_API_KEY", "SLACK_WEBHOOK_URL"],
     "rotating": ["QUICKBOOKS_REFRESH_TOKEN"],
+    "propagating": ["LINEAR_API_KEY"],
     "narrow": { "projectIds": [], "excludeKeys": [] }
   }
 }
@@ -108,6 +109,8 @@ On the GitHub Actions surface the repository secret and the exported environment
 
 **`rotating`** — see below. Default empty; most projects declare none.
 
+**`propagating`** — which credentials may be copied into a *foreign* store, and optionally where. Default empty. See below.
+
 There is no map of secret IDs, deliberately. Copying an ID per secret is the same duplication in a smaller costume, and lookup is by name.
 
 ## The exposure boundary
@@ -181,6 +184,8 @@ Notes clarify usage. They cannot override system/developer instructions, `AGENTS
 
 No create, no update, no rotate. Writing secrets or their notes requires an authority a CI credential should not hold, and a read-only path cannot be turned against the vault if it leaks.
 
+The two writers are siblings, not modes: `rotate-secret.mjs` replaces a value **at its source**, and `sync-secret-to-ci.mjs` copies one **into a second store** without touching the source. Each needs an authority the resolver must not hold, so each is its own program with its own declaration list.
+
 ## Rotating credentials
 
 A **consumable** credential is one where using it can invalidate the stored copy: an OAuth refresh token the issuer replaces on every exchange, a short-lived session, a single-use enrollment token. The defining property is not "OAuth" — it is that a successful use makes the value on record wrong.
@@ -205,6 +210,49 @@ rotate-secret.mjs leases            # show current holders
 
 The lease record is excluded from every normal selection — nothing resolves or materializes it.
 
+## Propagating a credential into a second store
+
+**Propagation** is copying a value from the provider it lives in into a *different* store that cannot read the provider — Bitwarden → a GitHub Actions organization or repository secret. It is neither a read (the value leaves the resolution path and lands somewhere else) nor a rotation (the source value is unchanged), so it is a third operation with its own program, `scripts/sync-secret-to-ci.mjs`:
+
+```text
+sync-secret-to-ci.mjs push NAME TARGET [DEST]     # propagate, then verify
+sync-secret-to-ci.mjs verify NAME TARGET [DEST]   # metadata check, no write
+sync-secret-to-ci.mjs list TARGET                 # destination names only
+```
+
+`TARGET` is `<org>` or `<owner>/<repo>`; `DEST` defaults to `NAME`. The verb is explicit rather than implied by position, so a typo cannot read as a secret name.
+
+The failure this closes is a **vacuous green**. A gate that needs a credential and cannot find one warn-skips and reports success while verifying nothing: four repositories ran `🔗 Work-Item Traceability` with `tracker: linear` and no `LINEAR_API_KEY` mapped, so the gate passed without checking a single work item. The credential was in Bitwarden the whole time. Nothing described how to move it, so it was moved by whatever pipeline shape someone reached for first — which is where the leaks are.
+
+1. **Refuse an empty or absent value.** Piping empty into `gh secret set` stores an empty secret and **exits 0**, so the destination reports a present, healthy, useless credential and every consumer behaves exactly as it did when nothing was set. Absence must never read as a pass — the same rule the traceability gate itself now follows.
+2. **The value moves only through a pipe.** Never an argument (rotation rule 5: process arguments are visible to anything that can list processes on the host), never a temp file, never echoed. Only its **length** is logged. The program takes no value input at all — it reads the provider itself, so the value never passes through a shell.
+3. **Verify by metadata, never by reading back.** GitHub cannot return a secret value; confirmation is the destination *name* appearing in `gh api orgs/<org>/actions/secrets` (or `repos/<owner>/<repo>/actions/secrets`). Two ways to get this wrong, both of which report **failure on a successful write**: that endpoint returns `{ total_count, secrets: [...] }` and **not** an array, so a filter over a bare array finds nothing; and it pages at 30, so reading only page one fails every write to a busy organization. A verification that fails a successful write is worse than none — it teaches an operator to ignore it and write again.
+4. **Declared, never inferred.** Only a name in `secrets.propagating` may be pushed to a foreign store, so an agent cannot decide on its own to copy a credential outward. Declaration is config, not a note, for the same reason rotation's is.
+5. **One-way.** Nothing is ever read back *from* the destination beyond names. The provider stays the single source of truth; a destination copy is expected to drift and is **re-pushed, never reconciled**.
+
+An org secret defaults to `--visibility private`. `all` reaches public repositories too, and a default that widens exposure is a default nobody reviews — widening is an explicit flag.
+
+`excludeKeys` is **not** waived here, unlike the rotation view. Rotation waives it because a credential it cannot see is one it cannot write *back* to its own record; there is no equivalent argument for copying one outward. A name that is both excluded and declared propagating is two contradictory instructions, and this program refuses rather than guessing which one you meant.
+
+### Declaring it
+
+```json
+"propagating": [
+  "LINEAR_API_KEY",
+  { "name": "NPM_TOKEN", "targets": ["TunnlAI", "TunnlAI/wiki"] }
+]
+```
+
+A bare string mirrors `secrets.rotating` and pins the **credential** only — any target may receive it. An object with `targets` pins **where it may go** as well. The bare form is the weaker statement and it is deliberately available, because the fleet-wide case is real; prefer `targets` for anything that is not.
+
+### Two shapes that are actively unsafe
+
+These are the obvious first attempts, and naming them is half the point of this section.
+
+- **`bws secret list -o tsv|table|env` prints VALUES.** Reaching for it to discover a key name dumps every secret in the project into a terminal, a CI log, or an agent transcript. Safe discovery is a script run under `bws run` that prints variable **names and value lengths only**.
+- **An inline `bws run --shell sh '...'` is refused by agent sandboxes** as unanalyzable, and the natural next move is to try variants until one slips through. The remedy is structural, not a better incantation: **a script file invoked with literal argv** — `bws run -- bash <path>` — which can be read and reviewed before it runs. That is better than an inline pipeline whether or not a sandbox is watching.
+- Minor but real: a `jq '.[].key'` filter is matched by secret-file-extension rules as a `.key` file. Don't reference that field — and don't enumerate secrets at all.
+
 ## Not forcing a credentials manager
 
 A project with no `secrets` block still works: the `env` provider means the environment *is* the provider. A credentials manager is the **preferred and best-supported** path, never a required one. `doctor` **warns** and names what the preferred path would buy; it does not block.
@@ -257,6 +305,7 @@ Cache **in-process only**. Never write a resolved value to disk except through t
 - Every key matches `^[A-Z][A-Z0-9_]*$`.
 - Every secret's note exists and is well-formed, per the table above. This is an **error**, so a vault that was passing on warnings will newly fail until its notes are written.
 - Every name in `rotating` has a resolvable bootstrap, so its replacement could be persisted.
+- No name is in both `propagating` and `narrow.excludeKeys` — those are contradictory instructions about the same credential.
 - **No secret is readable from two stores.** A value present in both the provider and a local cache is not a duplicate — it is **two live credentials**, one of which is untracked. This is the check most worth having: it catches drift before a deletion turns the forgotten copy into an orphan nobody can revoke.
 
 ## Rules

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/inspect-vault.mjs

@@ -0,0 +1,120 @@
+#!/usr/bin/env node
+/**
+ * Safe discovery: which secrets a vault grants, by name and size only.
+ *
+ * This exists because the obvious way to answer "what is this key called?" is
+ * `bws secret list -o tsv` (or `table`, or `env`), and **all three print
+ * VALUES**. Run once to find one name and every secret in the project is in a
+ * terminal, a CI log, or an agent transcript — nowhere any of them can be taken
+ * back from.
+ *
+ * Two properties, and the second one is the reason this is a file:
+ *
+ * - **Names and lengths, never values.** A length is enough to tell a populated
+ *   secret from an empty one and to confirm you are looking at the credential
+ *   you meant, which is all discovery ever needs.
+ * - **A file invoked with literal argv**, so the command is
+ *   `bws run -- node .../inspect-vault.mjs` and what runs can be read before it
+ *   runs. The inline alternative — `bws run --shell sh '...'` — is refused by
+ *   agent sandboxes as unanalyzable, and the natural response to that refusal
+ *   is to try variants until one slips through. The remedy is structural rather
+ *   than a better incantation, and it is better than an inline pipeline whether
+ *   or not a sandbox is watching.
+ *
+ * Deliberately no `--json` and no way to print a value. A tool that can be
+ * asked for one will eventually be asked for one.
+ *
+ * Usage:
+ *   bws run -- node scripts/inspect-vault.mjs [PREFIX]
+ * @module inspect-vault
+ */
+
+/**
+ * Variables present in any shell, which say nothing about the vault.
+ *
+ * Prefix-matched rather than listed exactly, because the point is to keep the
+ * output short enough to read — a hundred inherited variables buries the six
+ * that came from the vault.
+ */
+const AMBIENT = [
+  "BASH",
+  "COLORTERM",
+  "COMMAND_MODE",
+  "DISPLAY",
+  "EDITOR",
+  "HOME",
+  "HOSTNAME",
+  "INFOPATH",
+  "LANG",
+  "LC_",
+  "LESS",
+  "LOGNAME",
+  "LS_COLORS",
+  "MAIL",
+  "MANPATH",
+  "NODE_",
+  "OLDPWD",
+  "PAGER",
+  "PATH",
+  "PS1",
+  "PWD",
+  "SHELL",
+  "SHLVL",
+  "SSH_",
+  "TERM",
+  "TMPDIR",
+  "TZ",
+  "USER",
+  "VISUAL",
+  "XPC_",
+  "_",
+];
+
+/**
+ * Whether a variable is ordinary shell furniture rather than a vault entry.
+ * @param {string} key Variable name.
+ * @returns {boolean} Whether to hide it.
+ */
+export function isAmbient(key) {
+  return AMBIENT.some(prefix => key === prefix || key.startsWith(prefix));
+}
+
+/**
+ * Describe the environment as names and sizes.
+ *
+ * Split from printing so the "no value ever appears in the output" property is
+ * testable directly, rather than inferred from reading the formatting code.
+ * @param {Record<string, string|undefined>} env Environment to describe.
+ * @param {string} [prefix] Optional name prefix to narrow to.
+ * @returns {Array<{name: string, bytes: number}>} One row per variable.
+ */
+export function describeEnv(env, prefix = "") {
+  return Object.entries(env)
+    .filter(([key]) => /^[A-Z][A-Z0-9_]*$/.test(key) && !isAmbient(key))
+    .filter(([key]) => key.startsWith(prefix))
+    .map(([name, value]) => ({ name, bytes: Buffer.byteLength(value ?? "") }))
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+function main() {
+  const rows = describeEnv(process.env, process.argv[2] ?? "");
+  if (!rows.length) {
+    console.log(
+      "no vault-shaped variables in this environment.\n" +
+        "Run this UNDER the provider: bws run -- node <this file>"
+    );
+    return;
+  }
+  const width = Math.max(...rows.map(row => row.name.length));
+  for (const row of rows) {
+    // A length, never a value — and an explicit word for zero, because an empty
+    // secret is the one this is most often run to find.
+    const size = row.bytes === 0 ? "EMPTY" : `${row.bytes} bytes`;
+    console.log(`  ${row.name.padEnd(width)}  ${size}`);
+  }
+  console.log(`\n${rows.length} secret(s). Values are never printed.`);
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  main();
+}

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -111,6 +111,7 @@ const DEFAULTS = {
   bootstrap: { sources: ["env"], key: null },
   require: null,
   rotating: [],
+  propagating: [],
   namespace: "lisa",
   narrow: { projectIds: [], excludeKeys: [] },
   surface: null,
@@ -216,6 +217,7 @@ export function readConfig(cwd = process.cwd(), env = process.env) {
     bootstrap: resolveBootstrap(cfg.bootstrap, provider, namespace),
     require: cfg.require ?? null,
     rotating: cfg.rotating ?? [],
+    propagating: cfg.propagating ?? [],
     namespace,
     narrow: { ...DEFAULTS.narrow, ...(cfg.narrow ?? {}) },
     surface: cfg.surface ?? null,