@codyswann/lisa 4.10.5 → 4.10.7

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.10.5",
+  "version": "4.10.7",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/parity-safety-net.sh

@@ -12,8 +12,10 @@
 #     guards also match path-prefixed invocations like `/bin/rm` and `./rm`)
 #   - `rm -rf` of the cwd (`.`), a `..`-traversal path, a `~/`-anchored path,
 #     an absolute path outside the project (with a /tmp, /var/tmp, $TMPDIR
-#     allowance), a `$VAR` target other than $TMPDIR, or ANY recursive forced
-#     delete while cwd is $HOME
+#     allowance, each also matched by its symlink-resolved spelling so /tmp and
+#     /private/tmp are ONE location), a `$VAR` target that neither is $TMPDIR
+#     nor resolves through an unambiguous in-command assignment, or ANY
+#     recursive forced delete while cwd is $HOME
 #   - force-pushing a protected branch (main/master/production/prod/release) —
 #     feature-branch force-push stays allowed (sanctioned rebase workflow;
 #     deliberate divergence from upstream's any-branch block). Every git guard
@@ -45,9 +47,19 @@
 # CLOSED: any parse error exits 2 (a non-2 exit would be a non-blocking hook
 # error in Claude Code, silently failing open).
 #
+# Narrowed false-positive class (issue #3106): the rm TARGET WALK is now scoped
+# to the quoting region that contains the rm, so a recursive delete quoted as
+# PROSE no longer turns every later token on the line into a deletion target. A
+# variable in an unrelated argument — a `gh issue create --body-file "$G/x"`, a
+# `git commit -F "$MSG"` — is no longer read as the thing being deleted. An rm
+# outside quotes, or first inside its quoted run (`bash -c "rm -rf /"`,
+# `echo "$(rm -rf /)"`), still hands the whole statement to the walk. See
+# rm_scan_scope below for the rule and its accepted residual.
+#
 # Known accepted false-positive class: this is a text scan, not a shell engine,
 # so display commands quoting a destructive string (`echo "docs about rm -rf /"`)
-# can match. Upstream exempts those via an engine-only DISPLAY_COMMANDS list a
+# can match — including one whose target sits in the SAME quoted run as the
+# prose, which the #3106 scoping deliberately does not reach. Upstream exempts those via an engine-only DISPLAY_COMMANDS list a
 # grep hook cannot replicate. The same text-scan limit means the rm guard treats
 # a substitution-wrapped catastrophic delete as verdict-neutral (issue #1982): an
 # executable `echo "$(rm -rf /)"` is blocked, but so are inert twins the shell
@@ -271,6 +283,36 @@ project_dir="${CLAUDE_PROJECT_DIR:-$PWD}"
 tmp_dir_allow="${TMPDIR:-/tmp}"
 tmp_dir_allow="${tmp_dir_allow%/}"
 [ -n "$tmp_dir_allow" ] || tmp_dir_allow="/tmp"
+# Physical (symlink-resolved) spelling of an allowed root — issue #3106 arm B.
+# The allowance below is a set of LITERAL string prefixes, so on macOS, where
+# /tmp is a symlink to /private/tmp, one directory had two spellings and only
+# one of them was allowed: `rm -rf /tmp/x` passed while `rm -rf /private/tmp/x`
+# — the SAME directory, and the spelling an agent's own scratchpad path is
+# handed to it in — was refused as "outside the project". Two opposite verdicts
+# for one location is a defect regardless of which verdict is right.
+#
+# This widens no LOCATION. It adds the second name of a location the guard has
+# always allowed, computed from the filesystem rather than hardcoded, so a
+# platform where /tmp is not a symlink gains nothing. Falls back to the logical
+# path when the directory does not exist or resolves to `/`, so the allowance
+# can never become an empty or root-anchored prefix (an empty prefix would make
+# `""/*` match every absolute path).
+phys_dir() {
+  local logical="$1" real=""
+  real="$(cd -- "$logical" 2>/dev/null && pwd -P)" || real=""
+  case "$real" in
+    "" | /) printf '%s' "$logical" ;;
+    *) printf '%s' "$real" ;;
+  esac
+}
+project_dir_phys="$(phys_dir "$project_dir")"
+tmp_phys="$(phys_dir /tmp)"
+var_tmp_phys="$(phys_dir /var/tmp)"
+tmp_dir_allow_phys="$(phys_dir "$tmp_dir_allow")"
+[ -n "$project_dir_phys" ] || project_dir_phys="$project_dir"
+[ -n "$tmp_phys" ] || tmp_phys="/tmp"
+[ -n "$var_tmp_phys" ] || var_tmp_phys="/var/tmp"
+[ -n "$tmp_dir_allow_phys" ] || tmp_dir_allow_phys="$tmp_dir_allow"
 # Peel command-substitution wrappers off a token so an rm nested in `$(…)`,
 # backticks, `<(…)`/`>(…)`, a `"…"`/`'…'` quote, or a leading `\` alias-bypass
 # (`\rm`) is recognized and its target classified as if the token were unwrapped
@@ -310,6 +352,224 @@ strip_subst_wrappers() {
   done
   printf '%s' "$t"
 }
+# Decide which text of an rm statement the TARGET WALK may read — issue #3106
+# arm A. The statement selector matches the RAW command text, so a recursive
+# delete quoted as PROSE inside a string argument selects the line, and every
+# remaining token on it is then classified as a deletion target. Three
+# independent sightings in one day, all of them commands that delete nothing:
+# a `printf` reduction, a `gh issue create --title …` filing the report about
+# this guard, and a commit message describing it. Each was refused for a
+# variable in a LATER, unrelated argument.
+#
+# The rule is structural, with no allowlist of "display commands":
+#   - an rm invocation OUTSIDE any quote is real; the walk reads the whole
+#     statement, exactly as before (`rm -rf "$HOME"` keeps its target),
+#   - an rm at the START of its quoted run is an invocation the quote merely
+#     wraps (`bash -c "rm -rf /"`, `echo "$(rm -rf /)"`); the walk reads the
+#     whole statement, exactly as before,
+#   - an rm preceded by other words INSIDE its quoted run is prose; the walk is
+#     scoped to that run, so the rm's own quoted arguments are still classified
+#     in full while a variable in a later argument is no longer read as a
+#     deletion target.
+#
+# Failure directions all point at blocking: an unterminated quote, an
+# over-long statement, or any run the scan cannot place falls back to the whole
+# statement. Residual (accepted, documented): `eval "prose rm -rf" "$X"` would
+# concatenate its words at run time and is scoped to the first run here.
+rm_scan_scope() {
+  local stmt="$1"
+  local n=${#stmt}
+  # Long statements fall back to the full walk rather than pay a char scan.
+  if [ "$n" -gt 4000 ]; then
+    printf '%s' "$stmt"
+    return
+  fi
+  local i=0 ch q="" esc=0 outside="" cur_run="" first_rm_run="" found=0
+  while [ "$i" -lt "$n" ]; do
+    ch="${stmt:i:1}"
+    i=$((i + 1))
+    if [ "$esc" -eq 1 ]; then
+      esc=0
+      if [ -n "$q" ]; then cur_run="$cur_run$ch"; else outside="$outside$ch"; fi
+      continue
+    fi
+    if [ "$ch" = '\' ] && [ "$q" != "'" ]; then
+      esc=1
+      continue
+    fi
+    if [ -n "$q" ]; then
+      if [ "$ch" = "$q" ]; then
+        if [ "$found" -eq 0 ]; then
+          case "$cur_run" in
+            *[Rr][Mm]*)
+              if printf '%s' "$cur_run" | grep -Eiq -- "$RM_CMD"'([[:space:]]|$)'; then
+                found=1
+                first_rm_run="$cur_run"
+              fi
+              ;;
+          esac
+        fi
+        q=""
+        cur_run=""
+      else
+        cur_run="$cur_run$ch"
+      fi
+      continue
+    fi
+    case "$ch" in
+      '"' | "'")
+        q="$ch"
+        cur_run=""
+        ;;
+      *) outside="$outside$ch" ;;
+    esac
+  done
+  # An unterminated quote is text the scan cannot place: treat it as unquoted so
+  # the fallback below hands back the whole statement.
+  [ -z "$q" ] || outside="$outside$cur_run"
+  if printf '%s' "$outside" | grep -Eiq -- "$RM_CMD"'([[:space:]]|$)'; then
+    printf '%s' "$stmt"
+    return
+  fi
+  if [ "$found" -eq 0 ]; then
+    printf '%s' "$stmt"
+    return
+  fi
+  # `rm` first in its run (modulo whitespace and substitution/alias openers) is
+  # an invocation, not prose.
+  if printf '%s' "$first_rm_run" \
+    | grep -Eiq -- '^[[:space:]]*(\\|\$\(|`|\(|<\(|>\()*[[:space:]]*([[:alnum:]_./-]*/)?rm([[:space:]]|$)'; then
+    printf '%s' "$stmt"
+    return
+  fi
+  printf '%s' "$first_rm_run"
+}
+# Look up the ONE unambiguous assignment of NAME inside the command being
+# classified — issue #3106 arm B, the variable half.
+#
+# Prints the recorded right-hand side, or fails when the name is never assigned
+# here or is assigned more than one distinct value. Ambiguity must fail: the
+# last write wins at run time and a text scan cannot order writes against the
+# delete, so `V=/etc; rm -rf "$V"; V=/tmp/x` must not resolve to the harmless
+# one. Only assignments literally present in this command are ever trusted;
+# nothing is expanded from the hook's own environment.
+rm_assignment_value() {
+  local name="$1" hits="" count=""
+  case "$name" in
+    "" | *[!A-Za-z0-9_]*) return 1 ;;
+  esac
+  hits="$(printf '%s\n' "$normalized_command_str" | tr ';&|' '\n' \
+    | grep -oE "(^|[[:space:]])${name}=[^[:space:]]*" \
+    | sed -E "s/^.*${name}=//")"
+  [ -n "$hits" ] || return 1
+  count="$(printf '%s\n' "$hits" | sort -u | grep -c '' | tr -d '[:space:]')"
+  [ "$count" = "1" ] || return 1
+  printf '%s' "$(printf '%s\n' "$hits" | head -n 1)"
+}
+# Rewrite a leading `$NAME` / `${NAME}` in a deletion target to the value the
+# command itself assigns it, so the target is classified as if the agent had
+# written that value literally — issue #3106 arm B.
+#
+# The guard's standing reason for refusing variable targets is that "unset or
+# mistyped variables can point anywhere", and that reason survives intact: a
+# name with no in-command assignment, an ambiguous one, or a value that is
+# itself a command substitution never resolves and stays refused. What changes
+# is only that a target the agent could have spelled literally is no longer
+# refused for being spelled through a variable.
+resolve_var_prefix() {
+  local token="$1" name="" rest="" value=""
+  case "$token" in
+    '${'*'}'*)
+      name="${token#'${'}"
+      name="${name%%\}*}"
+      rest="${token#'${'"$name"'}'}"
+      ;;
+    '$'*)
+      rest="${token#'$'}"
+      name="${rest%%[!A-Za-z0-9_]*}"
+      rest="${rest#"$name"}"
+      ;;
+    *) return 1 ;;
+  esac
+  [ -n "$name" ] || return 1
+  value="$(rm_assignment_value "$name")" || return 1
+  # A value that is itself a command substitution names no location the guard
+  # can read, so it never resolves — the refusal stands. `$(…)` already fails
+  # below (its leading `$` yields no variable name); backticks are named here so
+  # both spellings of substitution behave the same way.
+  case "$value" in
+    *'`'*) return 1 ;;
+  esac
+  case "$value" in
+    '"'*'"')
+      value="${value#\"}"
+      value="${value%\"}"
+      ;;
+    "'"*"'")
+      value="${value#\'}"
+      value="${value%\'}"
+      ;;
+  esac
+  [ -n "$value" ] || return 1
+  printf '%s%s' "$value" "$rest"
+}
+# Classify ONE deletion target. Extracted from the token walk so a variable
+# target can be re-classified through every arm after resolution (#3106),
+# instead of the variable arm being a terminal verdict of its own.
+classify_rm_target() {
+  local token="$1" depth="${2:-0}" resolved=""
+  case "$token" in
+    -*) return 0 ;;
+    . | ./)
+      set +f
+      block "recursive forced delete of the current directory (rm -rf .)"
+      ;;
+    .. | ../* | */.. | */../*)
+      set +f
+      block "recursive forced delete of a path outside the project (.. traversal)"
+      ;;
+    '~' | '~'/*)
+      set +f
+      block "recursive forced delete of a home-anchored path (~/…) outside the project"
+      ;;
+    /*)
+      case "$token" in
+        "$project_dir" | "$project_dir"/* | "$project_dir_phys" | "$project_dir_phys"/* \
+          | /tmp | /tmp/* | "$tmp_phys" | "$tmp_phys"/* \
+          | /var/tmp | /var/tmp/* | "$var_tmp_phys" | "$var_tmp_phys"/* \
+          | "$tmp_dir_allow" | "$tmp_dir_allow"/* | "$tmp_dir_allow_phys" | "$tmp_dir_allow_phys"/*) : ;;
+        *)
+          set +f
+          block "recursive forced delete of an absolute path outside the project (only the project, /tmp, /var/tmp, and \$TMPDIR are allowed)"
+          ;;
+      esac
+      ;;
+    '*')
+      # Bare top-level wildcard expands to every entry in the cwd. Guard 1a no
+      # longer bounds `*)` (T4b F1), so a substitution-wrapped `rm -rf *` is
+      # caught here after the trailing-closer strip peels `*)"` down to `*`.
+      set +f
+      block "recursive forced delete of a top-level wildcard (rm -rf *)"
+      ;;
+    *'$'*)
+      case "$token" in
+        '$TMPDIR' | '$TMPDIR'/* | '${TMPDIR}' | '${TMPDIR}'/*) : ;;
+        *)
+          if [ "$depth" -lt 4 ] \
+            && resolved="$(resolve_var_prefix "$token")" \
+            && [ -n "$resolved" ] \
+            && [ "$resolved" != "$token" ]; then
+            classify_rm_target "$resolved" $((depth + 1))
+          else
+            set +f
+            block "recursive forced delete of a variable-expanded target (unset or mistyped variables can point anywhere; \$TMPDIR is the only sanctioned dynamic target)"
+          fi
+          ;;
+      esac
+      ;;
+  esac
+  return 0
+}
 while IFS= read -r rm_stmt; do
   if ! printf '%s' "$rm_stmt" | grep -Eiq -- "$RM_RF_CLUSTER" \
     && ! printf '%s' "$rm_stmt" | grep -Eiq -- "$RM_RF_SPLIT"; then
@@ -325,9 +585,13 @@ while IFS= read -r rm_stmt; do
     && [ "$(pwd -P)" = "$(cd -- "$HOME" 2>/dev/null && pwd -P)" ]; then
     block "recursive forced delete while the working directory is \$HOME (cd into a project first)"
   fi
+  # Scope the walk to the quoting region that actually contains the rm (#3106
+  # arm A). Unquoted and run-leading invocations get the whole statement back,
+  # so this is a no-op for every real delete.
+  rm_walk_text="$(rm_scan_scope "$rm_stmt")"
   set -f
   seen_rm=0
-  for raw_token in $rm_stmt; do
+  for raw_token in $rm_walk_text; do
     token="$(strip_subst_wrappers "$raw_token")"
     if [ "$seen_rm" -eq 0 ]; then
       # Path-prefixed spellings (`/bin/rm`, `./rm`) are still rm (F2).
@@ -336,46 +600,7 @@ while IFS= read -r rm_stmt; do
       esac
       continue
     fi
-    case "$token" in
-      -*) continue ;;
-      . | ./)
-        set +f
-        block "recursive forced delete of the current directory (rm -rf .)"
-        ;;
-      .. | ../* | */.. | */../*)
-        set +f
-        block "recursive forced delete of a path outside the project (.. traversal)"
-        ;;
-      '~' | '~'/*)
-        set +f
-        block "recursive forced delete of a home-anchored path (~/…) outside the project"
-        ;;
-      /*)
-        case "$token" in
-          "$project_dir" | "$project_dir"/* | /tmp | /tmp/* | /var/tmp | /var/tmp/* | "$tmp_dir_allow" | "$tmp_dir_allow"/*) : ;;
-          *)
-            set +f
-            block "recursive forced delete of an absolute path outside the project (only the project, /tmp, /var/tmp, and \$TMPDIR are allowed)"
-            ;;
-        esac
-        ;;
-      '*')
-        # Bare top-level wildcard expands to every entry in the cwd. Guard 1a no
-        # longer bounds `*)` (T4b F1), so a substitution-wrapped `rm -rf *` is
-        # caught here after the trailing-closer strip peels `*)"` down to `*`.
-        set +f
-        block "recursive forced delete of a top-level wildcard (rm -rf *)"
-        ;;
-      *'$'*)
-        case "$token" in
-          '$TMPDIR' | '$TMPDIR'/* | '${TMPDIR}' | '${TMPDIR}'/*) : ;;
-          *)
-            set +f
-            block "recursive forced delete of a variable-expanded target (unset or mistyped variables can point anywhere; \$TMPDIR is the only sanctioned dynamic target)"
-            ;;
-        esac
-        ;;
-    esac
+    classify_rm_target "$token"
   done
   set +f
 done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \

package/plugins/lisa-cursor/hooks/setup-jira-cli.sh

@@ -44,6 +44,56 @@ cat >/dev/null 2>&1 || true
 # one resolution rule, allowed to drift, is what produced the Codex half of
 # this defect in the first place.
 # ---------------------------------------------------------------------------
+
+# ---------------------------------------------------------------------------
+# WHO READS WHAT THIS WRITES — and why no per-harness env export is needed.
+#
+# `${PROJECT_DIR}/.lisa/jira-cli/.config.yml` had NO reader at all until
+# CodySwannGT/lisa#2767: the hook wrote a file, every consumer looked at
+# `${HOME}/.config/.jira/.config.yml` instead, and the hook was therefore an
+# inert control that reported success while feeding nothing. It now has three
+# consumers, all Lisa-owned:
+#
+#   * lisa-jira-evidence/scripts/post-evidence.sh — greps `server:`/`login:`
+#     out of this YAML, then passes `--config <path>` to `jira issue move`.
+#   * lisa-jira-read-ticket/scripts/download-attachment.sh — greps the same two
+#     keys, but ONLY when JIRA_SERVER/JIRA_LOGIN are unset. Env still wins; a
+#     headless runner with those exported never opens this file.
+#   * SKILL prose (lisa-jira-add-journey, base-rules) — types
+#     `jira --config .lisa/jira-cli/.config.yml issue view <KEY>`.
+#
+# #2767 framed the blocking question as "can a SessionStart hook export an
+# environment variable into the agent's later tool invocations, and does that
+# differ per harness?" That question is MOOT for every consumer above, because
+# none of them needs an export:
+#
+#   - Two of the three parse this YAML themselves, in Lisa-owned shell.
+#   - The one real jira-cli invocation passes `--config`, an ARGUMENT. It
+#     crosses no process boundary, so it behaves identically on Claude Code,
+#     Codex, Cursor, Copilot, OpenCode and Antigravity. There is no per-harness
+#     capability to record because no harness capability is used.
+#
+# The only surface where an export could still have mattered is a freehand
+# `jira ...` an agent types from SKILL prose. That is compensated at the same
+# rung rather than dropped: the prose types `--config` too. `JIRA_CONFIG_FILE`
+# is deliberately exported NOWHERE in Lisa — an unexported variable is another
+# inert control, and the flag makes the export unnecessary.
+#
+# jira-cli's own resolution order, MEASURED against v1.7.0 (darwin/arm64)
+# rather than taken from its README:
+#
+#   1. `--config`/`-c <path>`               (highest; accepted either before or
+#                                            after the subcommand)
+#   2. `JIRA_CONFIG_FILE=<path>`
+#   3. `${HOME}/.config/.jira/.config.yml`  (default)
+#
+# A path named by (1) or (2) that does not exist FAILS CLOSED: jira-cli prints
+# "Missing configuration file." and exits 1 — it does NOT fall back to (3).
+# That is what makes passing `--config` safe rather than a silent no-op.
+#
+# This hook never writes to `${HOME}/.config/.jira`. That is a developer's
+# personal jira-cli state; consumers read it as an ANNOUNCED fallback only.
+# ---------------------------------------------------------------------------
 PROJECT_DIR="${CLAUDE_PROJECT_DIR:-}"
 if [[ -z "${PROJECT_DIR}" || ! -d "${PROJECT_DIR}" ]]; then
   PROJECT_DIR="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"

package/plugins/lisa-cursor/rules/base-rules-reference.mdc

@@ -75,7 +75,7 @@ Testing Discipline:
 JIRA Discipline:
 - If working on a JIRA issue, make sure the branch you're working on references and is added to the JIRA issue.
 - If working on a JIRA issue, update the issue as you work through it. For example, if working on a Bug Triage, update the issue with your questions/feedback/suggestions.
-- When reading a JIRA issue, always read ALL comments on the ticket — not just the description. Comments contain critical context: stakeholder decisions, scope changes, blockers, triage findings from other repos, and implementation notes. Use the Atlassian MCP or `jira issue view <TICKET_ID> --comments 100` to fetch them.
+- When reading a JIRA issue, always read ALL comments on the ticket — not just the description. Comments contain critical context: stakeholder decisions, scope changes, blockers, triage findings from other repos, and implementation notes. Use the Atlassian MCP or `jira --config .lisa/jira-cli/.config.yml issue view <TICKET_ID> --comments 100` to fetch them (the `--config` pins jira-cli to the config the `setup-jira-cli` hook wrote; drop it to use the machine's own `~/.config/.jira/.config.yml`).
 - When requesting clarification on a JIRA issue, post the question as a comment using ADF (Atlassian Document Format) and @mention the Reporter so they receive a notification.
 - When creating JIRA tickets, establish issue link relationships (e.g. "is blocked by", "blocks", "relates to", "is duplicated by") between tickets that have dependencies or logical connections. Do not leave related tickets unlinked. Relationship discovery is mandatory on every create and update — search BOTH the local git history (`git log --all --grep=<keyword>`, `git log -- <path>`) AND Jira (JQL by component, keyword, label, epic siblings) before declaring "no related work." Record the searches you ran and their outcomes in the description (or a comment) so a reviewer can see the search was real.
 - Ticket scope by type: Bug, Task, and Sub-task tickets MUST be single-repo (one work unit, one repo). Epic, Spike, and Story tickets MAY span multiple repos. If a Bug/Task/Sub-task crosses repos, split it per the `repo-scope-split` rule — at PRD-decomposition time via `task-decomposition` step 1.5 (parent Story + per-repo children); at work-time (an existing ticket an agent is about to implement) via the work-time split procedure (narrow the original to one repo, spin off a sibling per additional repo cloning its metadata, link the producer→consumer dependency, then proceed). A cross-repo work unit is a decomposition error the agent fixes by splitting, not a reason to bounce the ticket to the reporter.

package/plugins/lisa-cursor/skills/lisa-jira-add-journey/SKILL.md

@@ -16,7 +16,12 @@ Read an existing JIRA ticket, analyze the change type, and generate a Validation
 ## Prerequisites
 
 - `JIRA_API_TOKEN` environment variable set
-- `jira-cli` configured (`~/.config/.jira/.config.yml`)
+- `jira-cli` configured. Prefer the config Lisa writes at
+  `.lisa/jira-cli/.config.yml` (the `setup-jira-cli` SessionStart hook writes it
+  from `JIRA_SERVER` / `JIRA_LOGIN` / `JIRA_PROJECT` on a project whose
+  `tracker` is `jira`), and pass it explicitly with `--config`. A developer's
+  own `~/.config/.jira/.config.yml` still works as jira-cli's default when no
+  `--config` is given.
 
 ## Workflow
 
@@ -25,9 +30,18 @@ Read an existing JIRA ticket, analyze the change type, and generate a Validation
 Use the Atlassian MCP or jira-cli to read the full ticket details:
 
 ```bash
-jira issue view <TICKET_ID>
+# Run from the project root. --config pins jira-cli to the file Lisa's
+# setup-jira-cli hook wrote, instead of the machine's own ~/.config/.jira.
+# jira-cli resolves --config > JIRA_CONFIG_FILE > ~/.config/.jira/.config.yml,
+# and a --config path that does not exist fails closed with "Missing
+# configuration file." rather than silently using the default.
+jira --config .lisa/jira-cli/.config.yml issue view <TICKET_ID>
 ```
 
+If `.lisa/jira-cli/.config.yml` does not exist, drop `--config` to fall back to
+the machine's own jira-cli config — but say so in your report rather than
+letting the Lisa-written config go quietly unused.
+
 Extract: title, description, acceptance criteria, components, labels, linked tickets.
 
 ### Step 2: Check for Existing Journey

package/plugins/lisa-cursor/skills/lisa-jira-evidence/SKILL.md

@@ -35,7 +35,10 @@ Upload captured evidence and generated templates to GitHub PR description and JI
 ## Prerequisites
 
 - `JIRA_API_TOKEN` environment variable set
-- `jira-cli` configured (`~/.config/.jira/.config.yml`) — server and login are read from there
+- a jira-cli config — `.lisa/jira-cli/.config.yml` if the `setup-jira-cli`
+  SessionStart hook wrote one, otherwise `~/.config/.jira/.config.yml`. `server`
+  and `login` are read from whichever is used, and the fallback is announced on
+  stderr rather than taken silently.
 - `gh` CLI authenticated
 - Evidence directory containing:
   - `NN-name.txt` or `NN-name.json` text evidence files (e.g., `01-health-check.json`)
@@ -66,7 +69,7 @@ bash .claude/skills/jira-evidence/scripts/post-evidence.sh PROJ-123 ./evidence 4
 
 ## What It Does
 
-1. **Read JIRA config** — Reads `~/.config/.jira/.config.yml` to obtain `server` and `login` dynamically
+1. **Read JIRA config** — Resolves the jira-cli config (`$PROJECT_DIR/.lisa/jira-cli/.config.yml` first, then `~/.config/.jira/.config.yml`, announcing the fallback) and reads `server` and `login` from it dynamically — no hardcoded values. Exits 1 naming both paths when neither exists. The same resolved path is then passed to `jira issue move` as `--config`, so the CLI cannot end up on a different config than the one this script parsed.
 2. **Upload to GitHub `pr-assets` release** — Uploads evidence files via `gh release upload --clobber`
 3. **Update PR description** — Replaces or appends the `## Evidence` section in the PR body
 4. **Post JIRA comment** — Posts `comment.txt` as a new comment (wiki markup with code blocks)
@@ -97,4 +100,4 @@ gh release create pr-assets --title "PR Assets" --notes "CDN for PR evidence"
 
 ### JIRA API returns 403
 
-Ensure `JIRA_API_TOKEN` is set and `login` in `~/.config/.jira/.config.yml` matches your Atlassian account email.
+Ensure `JIRA_API_TOKEN` is set and `login` in the resolved jira-cli config (`.lisa/jira-cli/.config.yml`, else `~/.config/.jira/.config.yml`) matches your Atlassian account email.

package/plugins/lisa-cursor/skills/lisa-jira-evidence/scripts/post-evidence.sh

@@ -6,7 +6,11 @@
 #
 # Prerequisites:
 #   - JIRA_API_TOKEN env var set
-#   - jira-cli configured (~/.config/.jira/.config.yml)
+#   - a jira-cli config, resolved in this order (see "CONFIG RESOLUTION" below):
+#       1. ${PROJECT_DIR}/.lisa/jira-cli/.config.yml  (written by the
+#          setup-jira-cli SessionStart hook from the JIRA_* environment)
+#       2. ~/.config/.jira/.config.yml                (a developer's own
+#          `jira init` config; announced on stderr when it is used)
 #   - gh CLI authenticated
 #
 # What it does:
@@ -23,9 +27,50 @@ TICKET_ID="${1:?Usage: post-evidence.sh <TICKET_ID> <EVIDENCE_DIR> <PR_NUMBER>}"
 EVIDENCE_DIR="${2:?Usage: post-evidence.sh <TICKET_ID> <EVIDENCE_DIR> <PR_NUMBER>}"
 PR_NUMBER="${3:?Usage: post-evidence.sh <TICKET_ID> <EVIDENCE_DIR> <PR_NUMBER>}"
 
-JIRA_CONFIG="${HOME}/.config/.jira/.config.yml"
-if [[ ! -f "$JIRA_CONFIG" ]]; then
-  echo "ERROR: jira-cli config not found at $JIRA_CONFIG — run 'jira init' first" >&2
+# ─────────────────────────────────────────────────────────────────────────────
+# CONFIG RESOLUTION
+#
+# The setup-jira-cli SessionStart hook writes ${PROJECT_DIR}/.lisa/jira-cli/
+# .config.yml. Nothing read it — this script looked only at the developer's own
+# ~/.config/.jira/.config.yml and exited 1 telling the operator to run
+# `jira init`, so on a headless JIRA project the hook was an inert control.
+# See CodySwannGT/lisa#2767.
+#
+# PROJECT_DIR is resolved with the same rule as the hook that writes the file,
+# deliberately character-for-character: CLAUDE_PROJECT_DIR (the harness's own
+# declaration of the root, inert on harnesses that never set it), then the git
+# toplevel, then pwd. A session launched from a subdirectory otherwise reads a
+# directory it never wrote — the #2768 defect, on the read side.
+#
+# Nothing here writes to ~/.config/.jira. That file is a developer's personal
+# jira-cli state; it is read as a fallback and never created or modified.
+#
+# NOTE: the `.lisa.config.json` reads in Step 5 below are still resolved from
+# the process working directory. That is pre-existing and out of scope here.
+# ─────────────────────────────────────────────────────────────────────────────
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-}"
+if [[ -z "${PROJECT_DIR}" || ! -d "${PROJECT_DIR}" ]]; then
+  PROJECT_DIR="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+fi
+PROJECT_JIRA_CONFIG="${PROJECT_DIR}/.lisa/jira-cli/.config.yml"
+HOME_JIRA_CONFIG="${HOME}/.config/.jira/.config.yml"
+
+if [[ -f "$PROJECT_JIRA_CONFIG" ]]; then
+  JIRA_CONFIG="$PROJECT_JIRA_CONFIG"
+elif [[ -f "$HOME_JIRA_CONFIG" ]]; then
+  # Announced, never silent. A silent fall-through to the developer's own file
+  # is precisely how the Lisa-written config stayed unconsumed without anyone
+  # noticing, and on a headless runner there is no such file to fall back to.
+  echo "NOTE: no Lisa-written jira-cli config at $PROJECT_JIRA_CONFIG" >&2
+  echo "      falling back to the developer config at $HOME_JIRA_CONFIG" >&2
+  JIRA_CONFIG="$HOME_JIRA_CONFIG"
+else
+  echo "ERROR: jira-cli config not found." >&2
+  echo "  Lisa-written config (expected): $PROJECT_JIRA_CONFIG" >&2
+  echo "  developer config (fallback):    $HOME_JIRA_CONFIG" >&2
+  echo "  Fix: export JIRA_SERVER, JIRA_LOGIN (and JIRA_INSTALLATION," >&2
+  echo "  JIRA_PROJECT) and start a new session so the setup-jira-cli hook" >&2
+  echo "  writes the project config — or run 'jira init' locally." >&2
   exit 1
 fi
 JIRA_SERVER=$(grep '^server:' "$JIRA_CONFIG" | awk '{print $2}')
@@ -169,7 +214,13 @@ fi
 echo ""
 if [ -n "$REVIEW" ]; then
   echo "==> Moving $TICKET_ID to $REVIEW..."
-  jira issue move "$TICKET_ID" "$REVIEW" 2>&1 && echo "  ✓ Ticket moved to $REVIEW" || echo "  WARNING: Could not move ticket to $REVIEW (not a valid transition?); leaving in current status" >&2
+  # --config pins jira-cli to the same file this script parsed above.
+  # jira-cli resolves --config > JIRA_CONFIG_FILE > ~/.config/.jira/
+  # .config.yml, and a --config path that does not exist fails closed
+  # rather than falling back (measured against jira-cli v1.7.0). The flag
+  # needs no environment export, so this works identically on every
+  # harness — see the harness note in the setup-jira-cli hook.
+  jira --config "$JIRA_CONFIG" issue move "$TICKET_ID" "$REVIEW" 2>&1 && echo "  ✓ Ticket moved to $REVIEW" || echo "  WARNING: Could not move ticket to $REVIEW (not a valid transition?); leaving in current status" >&2
 else
   echo "==> No jira.workflow.review configured; leaving $TICKET_ID in its current (claimed) status per config-resolution."
 fi

package/plugins/lisa-cursor/skills/lisa-jira-journey/SKILL.md

@@ -20,7 +20,8 @@ Parse a JIRA ticket's Validation Journey, execute the verification steps using t
 ## Prerequisites
 
 - `JIRA_API_TOKEN` environment variable set
-- `jira-cli` configured (`~/.config/.jira/.config.yml`)
+- `jira-cli` configured — `.lisa/jira-cli/.config.yml` (written by the
+  `setup-jira-cli` SessionStart hook) or `~/.config/.jira/.config.yml`
 - `gh` CLI authenticated
 - Appropriate services running for the verification type (dev server, database, etc.)