@codyswann/lisa 3.26.0 → 3.26.2

package/plugins/lisa/hooks/block-managed-file-edits.sh

@@ -1,10 +1,9 @@
 #!/usr/bin/env bash
 # PreToolUse hook: refuse agent writes to files Lisa overwrites on every apply.
 #
-# Lisa ships templates in three modes, and only one of them destroys host edits:
+# Lisa ships templates in three modes, and only one of them is unsafe to edit:
 #
-#   copy-overwrite — replaced wholesale on every `lisa apply`. An edit here is
-#                    gone at the next `bun install`, silently.
+#   copy-overwrite — see below; the harm depends on the file.
 #   copy-contents  — Lisa APPENDS its lines; host content survives.
 #   create-only    — skipped when the file exists; the host owns it outright.
 #
@@ -12,6 +11,21 @@
 # would stop agents editing files they are supposed to own, which is worse than
 # the problem being solved.
 #
+# WITHIN copy-overwrite there are two populations with OPPOSITE consequences,
+# and an earlier version of this guard described only one of them:
+#
+#   hash-tracked guards (the `.mjs` scripts, listed in the Lisa-owned ledger)
+#     — an edit classifies as `host-modified` and `lisa apply` PRESERVES it.
+#       The file silently forks and stops receiving upstream fixes while looking
+#       current. Nothing is deleted; that is what makes it hard to notice.
+#   everything else (`.json` configs and friends)
+#     — replaced wholesale on the next apply, which runs on every install.
+#       The edit vanishes.
+#
+# The refusal branches on ledger membership so it states the consequence that
+# actually applies, rather than describing both and leaving the reader to work
+# out which they are in.
+#
 # Measured, not hypothetical. Nothing enforced this, so downstream copies were
 # edited and then silently diverged: `classify-maestro-failures.mjs` reached
 # 36,061 bytes in one fleet repo against 29,586 shipped, and five gate files in
@@ -67,6 +81,71 @@ if [ -f "$project_root/package.json" ] &&
   exit 0
 fi
 
+# Whether the project has claimed a path in `.lisaignore`.
+#
+# THIS IS THE OWNERSHIP QUESTION, and it decides whether blocking is right at
+# all. `lisa apply` skips an ignored path — it logs `Kept (.lisaignore)` and
+# counts it as ignored rather than overwritten — so the file is the project's,
+# its edits survive, and refusing them would be refusing someone access to their
+# own file. `doctor-lisa-owned-artifacts` already consults this list; this guard
+# did not, which would have blocked deliberate forks.
+#
+# The real matcher is minimatch in `src/utils/ignore-patterns.ts` and cannot be
+# reproduced faithfully in shell. This covers the common shapes — exact path,
+# directory prefix, glob, and a bare pattern matching any segment — and where it
+# is unsure it ALLOWS. Wrongly allowing costs an edit that apply may overwrite,
+# which is the behaviour before this guard existed; wrongly blocking locks
+# someone out of a file they own.
+lisaignored() {
+  local rel="$1"
+  local list="$project_root/.lisaignore"
+  [ -f "$list" ] || return 1
+  local pattern
+  while IFS= read -r pattern || [ -n "$pattern" ]; do
+    pattern="${pattern#"${pattern%%[![:space:]]*}"}"
+    pattern="${pattern%"${pattern##*[![:space:]]}"}"
+    [ -n "$pattern" ] || continue
+    case "$pattern" in \#*) continue ;; esac
+    # A leading `!` is not gitignore negation here. The real matcher passes
+    # patterns to minimatch, which negates by default, and it combines them with
+    # `.some()` — so a single `!scripts/a.mjs` line reports EVERY OTHER PATH as
+    # ignored. Measured:
+    #
+    #   patterns=["!scripts/a.mjs"]  path=scripts/a.mjs -> ignored=false
+    #   patterns=["!scripts/a.mjs"]  path=scripts/b.mjs -> ignored=TRUE
+    #
+    # Reproducing that faithfully would mean disabling this guard on a typo.
+    # Reproducing the intuitive gitignore reading would mean blocking files the
+    # matcher considers ignored. Both are wrong, so the file is treated as
+    # claimed and the write is allowed — the same direction this function errs
+    # everywhere else. Filed upstream; when the matcher stops negating, delete
+    # this branch rather than teaching it a second wrong answer.
+    case "$pattern" in !*) return 0 ;; esac
+    case "$pattern" in
+      */)
+        case "$rel" in "${pattern%/}"/* | "${pattern%/}") return 0 ;; esac
+        ;;
+    esac
+    # shellcheck disable=SC2254 -- the pattern is a glob on purpose.
+    case "$rel" in $pattern) return 0 ;; esac
+    case "$pattern" in
+      */*) ;;
+      *)
+        # shellcheck disable=SC2254 -- ditto, matched against the basename.
+        case "${rel##*/}" in $pattern) return 0 ;; esac
+        ;;
+    esac
+  done <"$list"
+  return 1
+}
+
+# A candidate rewritten relative to the project, so an absolute target from a
+# tool payload and a relative one from a shell command classify identically.
+relative_path() {
+  local rel="${1#"$project_root"/}"
+  printf '%s' "${rel#./}"
+}
+
 # Whether a host-relative path is shipped as a copy-overwrite template.
 #
 # A few stat calls rather than an enumeration: the same relative path is probed
@@ -77,10 +156,11 @@ managed_source() {
   case "$candidate" in
     */node_modules/* | node_modules/* | */dist/* | dist/*) return 1 ;;
   esac
-  # Normalise to a project-relative path so an absolute target still matches.
-  local rel="${candidate#"$project_root"/}"
-  rel="${rel#./}"
+  local rel
+  rel="$(relative_path "$candidate")"
   [ -n "$rel" ] || return 1
+  # Claimed by the project, so not ours to refuse.
+  lisaignored "$rel" && return 1
   local stack
   for stack in "$package_root"/*/copy-overwrite; do
     [ -d "$stack" ] || continue
@@ -92,19 +172,44 @@ managed_source() {
   return 1
 }
 
+# Whether a destination is a ledger-tracked Lisa-owned guard.
+#
+# The two populations behind this guard have OPPOSITE consequences, so the
+# refusal has to know which one it is looking at rather than describing both and
+# leaving the reader to guess. A guard in the content-hash ledger classifies as
+# `host-modified` once edited and `lisa apply` PRESERVES it; anything else is
+# replaced wholesale. Both are bad, for different reasons, and the right next
+# step differs too.
+ledger_tracked() {
+  local rel="$1"
+  local ledger="$package_root/dist/core/lisa-owned-hash-ledger.js"
+  [ -f "$ledger" ] || return 1
+  grep -q "\"$rel\"" "$ledger" 2>/dev/null
+}
+
 refuse() {
   local target="$1"
   local source="$2"
+  local rel="$3"
+  local consequence
+  if ledger_tracked "$rel"; then
+    consequence="This is a Lisa-owned guard, tracked by content hash. \`lisa apply\`
+will PRESERVE your edit rather than overwrite it — and that is the trap. The
+file silently forks: it keeps looking current while every upstream fix stops
+reaching it. One repository in this fleet is carrying 243 lines of divergence
+nobody knew about, in a guard that had quietly stopped receiving fixes."
+  else
+    consequence="This template is not hash-tracked, so \`lisa apply\` REPLACES it
+wholesale — and apply runs on every \`bun install\`. Your edit survives until the
+next install and then vanishes, with nothing reporting that it had."
+  fi
   cat >&2 <<EOF
 BLOCKED: refusing to write \`$target\`.
 
-WHY: this file is Lisa-managed. It is shipped as a **copy-overwrite** template
-(\`$source\` in the installed package) and is replaced wholesale on every
-\`lisa apply\` — which runs on every \`bun install\`. Your edit would survive
-until the next install and then vanish, with nothing reporting that it had.
+WHY: this file is Lisa-managed, shipped as a **copy-overwrite** template
+(\`$source\` in the installed package).
 
-That is not hypothetical: downstream copies edited this way diverged silently
-until they stopped receiving upstream fixes entirely.
+$consequence
 
 WHERE IT GOES INSTEAD — take the first one that fits:
 
@@ -122,7 +227,23 @@ WHERE IT GOES INSTEAD — take the first one that fits:
    proves each one, so a project can substitute its own task without touching a
    shipped file.
 
-4. You believe this file should not be Lisa-managed at all. That is a real
+4. This project has deliberately FORKED this file and means to keep its own
+   version. What to do depends on which population it is, and \`.lisaignore\` is
+   the WRONG answer for a hash-tracked guard:
+
+   - **A Lisa-owned guard (hash-tracked).** Do NOT add it to \`.lisaignore\`. The
+     ledger already preserves your version, so ignoring it buys nothing — and it
+     silences the standoff \`lisa doctor\` reports on every run, replacing a true
+     warning with the line "Enforcement guards match the installed Lisa
+     version", which is then false. A visible, resolvable fork becomes a silent
+     permanent one. Keep the warning and resolve the fork: upstream what is
+     general, or accept the standoff knowingly. To make this one edit, use the
+     override below.
+   - **Any other template.** \`.lisaignore\` is the right answer. Nothing else
+     preserves it, and the entry declares the divergence where the next person
+     can see it.
+
+5. You believe this file should not be Lisa-managed at all. That is a real
    argument and it belongs upstream, not in a local edit that will be erased.
 
 If a human explicitly asked for this edit, they can re-run with
@@ -142,7 +263,7 @@ case "$tool_name" in
     while IFS= read -r candidate; do
       [ -n "$candidate" ] || continue
       if source_path="$(managed_source "$candidate")"; then
-        refuse "$candidate" "$source_path"
+        refuse "$candidate" "$source_path" "$(relative_path "$candidate")"
       fi
     done <<EOF
 $paths
@@ -157,7 +278,7 @@ EOF
     while IFS= read -r token; do
       [ -n "$token" ] || continue
       if source_path="$(managed_source "$token")"; then
-        refuse "$token" "$source_path"
+        refuse "$token" "$source_path" "$(relative_path "$token")"
       fi
     done <<EOF
 $(printf '%s' "$command_str" |

package/plugins/lisa/skills/lisa-atlassian-access/scripts/markdown-to-adf.mjs

@@ -202,7 +202,29 @@ function parseInline(text) {
   return nodes.length > 0 ? nodes : [{ type: "text", text: "" }];
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   let input = "";
   process.stdin.setEncoding("utf8");
   process.stdin.on("data", chunk => {

package/plugins/lisa/skills/lisa-detect-tooling/scripts/detect-tooling.mjs

@@ -22,7 +22,14 @@
  * @module detect-tooling
  */
 
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import {
+  existsSync,
+  readFileSync,
+  readdirSync,
+  statSync,
+  realpathSync,
+} from "node:fs";
+import { fileURLToPath } from "node:url";
 import { join } from "node:path";
 
 import { commandsIn } from "./commands.mjs";
@@ -583,7 +590,29 @@ export function proposedEntries(proposal) {
   };
 }
 
-if (process.argv[1] && import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   const proposals = detectTooling();
   if (process.argv.includes("--json")) {
     console.log(JSON.stringify(proposals, null, 2));

package/plugins/lisa/skills/lisa-remote-dispatch/scripts/dispatch.mjs

@@ -20,7 +20,13 @@
  */
 
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+  realpathSync,
+} from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -495,7 +501,29 @@ async function main() {
   console.log(`recorded in ${LEDGER}; not polling — this process is done.`);
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   // Awaited rather than called bare: one dispatch path is async, so a synchronous
   // try/catch would let a rejection escape as an unhandled rejection and exit 0 —
   // reporting dispatched work that was never accepted.

package/plugins/lisa/skills/lisa-secrets-access/scripts/doctor-secrets.mjs

@@ -18,6 +18,8 @@
  */
 
 import { createHash } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
 
 import { validateNote } from "./note-format.mjs";
 import { fetchAll, fetchRotatable } from "./providers.mjs";
@@ -239,7 +241,29 @@ function main() {
   if (errors) throw new Error(`${errors} secrets configuration error(s)`);
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   try {
     main();
   } catch (err) {

package/plugins/lisa/skills/lisa-secrets-access/scripts/inspect-vault.mjs

@@ -115,6 +115,28 @@ function main() {
   console.log(`\n${rows.length} secret(s). Values are never printed.`);
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   main();
 }

package/plugins/lisa/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -30,6 +30,7 @@ import {
 } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 
 import {
   BOOTSTRAP_KEY,
@@ -454,7 +455,29 @@ function main() {
   }
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   try {
     main();
   } catch (err) {

package/plugins/lisa/skills/lisa-secrets-access/scripts/read-secret-note.mjs

@@ -13,7 +13,8 @@
  * @module read-secret-note
  */
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 
 import { materializedPaths, readConfig } from "./surfaces.mjs";
 
@@ -72,7 +73,29 @@ function main() {
   console.log(noteFor(name, loadNotes(notesFile)));
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   try {
     main();
   } catch (err) {

package/plugins/lisa/skills/lisa-secrets-access/scripts/resolve-secret.mjs

@@ -27,7 +27,8 @@
  * @module resolve-secret
  */
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 
 import { parseEnv } from "./envfile.mjs";
 import { validateNote } from "./note-format.mjs";
@@ -252,7 +253,29 @@ function main() {
   );
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   try {
     main();
   } catch (err) {

package/plugins/lisa/skills/lisa-secrets-access/scripts/rotate-secret.mjs

@@ -27,7 +27,8 @@
  * @module rotate-secret
  */
 
-import { readFileSync } from "node:fs";
+import { readFileSync, realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import { hostname } from "node:os";
 
 import {
@@ -264,7 +265,29 @@ function main() {
   );
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   try {
     main();
   } catch (err) {

package/plugins/lisa/skills/lisa-secrets-access/scripts/sync-secret-to-ci.mjs

@@ -48,6 +48,8 @@
  */
 
 import { execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
 
 import { ENV_KEY, fetchAll } from "./providers.mjs";
 import { readConfig } from "./surfaces.mjs";
@@ -471,7 +473,29 @@ function main() {
   );
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   try {
     main();
   } catch (err) {

package/plugins/lisa/skills/lisa-secrets-access/scripts/validate-config.mjs

@@ -16,7 +16,8 @@
  * @module validate-config
  */
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import { join } from "node:path";
 
 import { SURFACES as SURFACE_CAPABILITIES } from "./surfaces.mjs";
@@ -517,7 +518,29 @@ function main() {
   throw new Error(`${problems.length} configuration problem(s)`);
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   try {
     main();
   } catch (err) {