@codyswann/lisa 4.13.1 → 4.13.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (106) hide show
  1. package/dist/core/upstream-evidence-manifest.d.ts.map +1 -1
  2. package/dist/core/upstream-evidence-manifest.js +11 -9
  3. package/dist/core/upstream-evidence-manifest.js.map +1 -1
  4. package/package.json +1 -1
  5. package/plugins/lisa/.claude-plugin/plugin.json +1 -1
  6. package/plugins/lisa/.codex-plugin/plugin.json +1 -1
  7. package/plugins/lisa/.codex-plugin/skills/lisa-atlassian-access/SKILL.md +48 -6
  8. package/plugins/lisa/.codex-plugin/skills/lisa-jam-access/SKILL.md +38 -2
  9. package/plugins/lisa/.codex-plugin/skills/lisa-notion-access/SKILL.md +47 -6
  10. package/plugins/lisa/.codex-plugin/skills/lisa-posthog-access/SKILL.md +38 -2
  11. package/plugins/lisa/.codex-plugin/skills/lisa-sentry-access/SKILL.md +38 -2
  12. package/plugins/lisa/.codex-plugin/skills/lisa-setup-atlassian/SKILL.md +53 -7
  13. package/plugins/lisa/.codex-plugin/skills/lisa-setup-notion/SKILL.md +53 -7
  14. package/plugins/lisa/.codex-plugin/skills/lisa-sonarcloud-access/SKILL.md +49 -7
  15. package/plugins/lisa/rules/reference/config-resolution.md +43 -6
  16. package/plugins/lisa/skills/lisa-atlassian-access/SKILL.md +48 -6
  17. package/plugins/lisa/skills/lisa-jam-access/SKILL.md +38 -2
  18. package/plugins/lisa/skills/lisa-notion-access/SKILL.md +47 -6
  19. package/plugins/lisa/skills/lisa-posthog-access/SKILL.md +38 -2
  20. package/plugins/lisa/skills/lisa-sentry-access/SKILL.md +38 -2
  21. package/plugins/lisa/skills/lisa-setup-atlassian/SKILL.md +53 -7
  22. package/plugins/lisa/skills/lisa-setup-notion/SKILL.md +53 -7
  23. package/plugins/lisa/skills/lisa-sonarcloud-access/SKILL.md +49 -7
  24. package/plugins/lisa-agy/plugin.json +1 -1
  25. package/plugins/lisa-agy/skills/lisa-atlassian-access/SKILL.md +48 -6
  26. package/plugins/lisa-agy/skills/lisa-jam-access/SKILL.md +38 -2
  27. package/plugins/lisa-agy/skills/lisa-notion-access/SKILL.md +47 -6
  28. package/plugins/lisa-agy/skills/lisa-posthog-access/SKILL.md +38 -2
  29. package/plugins/lisa-agy/skills/lisa-sentry-access/SKILL.md +38 -2
  30. package/plugins/lisa-agy/skills/lisa-setup-atlassian/SKILL.md +53 -7
  31. package/plugins/lisa-agy/skills/lisa-setup-notion/SKILL.md +53 -7
  32. package/plugins/lisa-agy/skills/lisa-sonarcloud-access/SKILL.md +49 -7
  33. package/plugins/lisa-cdk/.claude-plugin/plugin.json +1 -1
  34. package/plugins/lisa-cdk/.codex-plugin/plugin.json +1 -1
  35. package/plugins/lisa-cdk-agy/plugin.json +1 -1
  36. package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json +1 -1
  37. package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json +1 -1
  38. package/plugins/lisa-copilot/.claude-plugin/plugin.json +1 -1
  39. package/plugins/lisa-copilot/rules/reference/config-resolution.md +43 -6
  40. package/plugins/lisa-copilot/skills/lisa-atlassian-access/SKILL.md +48 -6
  41. package/plugins/lisa-copilot/skills/lisa-jam-access/SKILL.md +38 -2
  42. package/plugins/lisa-copilot/skills/lisa-notion-access/SKILL.md +47 -6
  43. package/plugins/lisa-copilot/skills/lisa-posthog-access/SKILL.md +38 -2
  44. package/plugins/lisa-copilot/skills/lisa-sentry-access/SKILL.md +38 -2
  45. package/plugins/lisa-copilot/skills/lisa-setup-atlassian/SKILL.md +53 -7
  46. package/plugins/lisa-copilot/skills/lisa-setup-notion/SKILL.md +53 -7
  47. package/plugins/lisa-copilot/skills/lisa-sonarcloud-access/SKILL.md +49 -7
  48. package/plugins/lisa-cursor/.claude-plugin/plugin.json +1 -1
  49. package/plugins/lisa-cursor/rules/config-resolution-reference.mdc +43 -6
  50. package/plugins/lisa-cursor/skills/lisa-atlassian-access/SKILL.md +48 -6
  51. package/plugins/lisa-cursor/skills/lisa-jam-access/SKILL.md +38 -2
  52. package/plugins/lisa-cursor/skills/lisa-notion-access/SKILL.md +47 -6
  53. package/plugins/lisa-cursor/skills/lisa-posthog-access/SKILL.md +38 -2
  54. package/plugins/lisa-cursor/skills/lisa-sentry-access/SKILL.md +38 -2
  55. package/plugins/lisa-cursor/skills/lisa-setup-atlassian/SKILL.md +53 -7
  56. package/plugins/lisa-cursor/skills/lisa-setup-notion/SKILL.md +53 -7
  57. package/plugins/lisa-cursor/skills/lisa-sonarcloud-access/SKILL.md +49 -7
  58. package/plugins/lisa-expo/.claude-plugin/plugin.json +1 -1
  59. package/plugins/lisa-expo/.codex-plugin/plugin.json +1 -1
  60. package/plugins/lisa-expo-agy/plugin.json +1 -1
  61. package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json +1 -1
  62. package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json +1 -1
  63. package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json +1 -1
  64. package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json +1 -1
  65. package/plugins/lisa-harper-fabric-agy/plugin.json +1 -1
  66. package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json +1 -1
  67. package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json +1 -1
  68. package/plugins/lisa-nestjs/.claude-plugin/plugin.json +1 -1
  69. package/plugins/lisa-nestjs/.codex-plugin/plugin.json +1 -1
  70. package/plugins/lisa-nestjs-agy/plugin.json +1 -1
  71. package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json +1 -1
  72. package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json +1 -1
  73. package/plugins/lisa-openclaw/.claude-plugin/plugin.json +1 -1
  74. package/plugins/lisa-openclaw/.codex-plugin/plugin.json +1 -1
  75. package/plugins/lisa-openclaw-agy/plugin.json +1 -1
  76. package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json +1 -1
  77. package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json +1 -1
  78. package/plugins/lisa-phaser/.claude-plugin/plugin.json +1 -1
  79. package/plugins/lisa-phaser/.codex-plugin/plugin.json +1 -1
  80. package/plugins/lisa-phaser-agy/plugin.json +1 -1
  81. package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json +1 -1
  82. package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json +1 -1
  83. package/plugins/lisa-rails/.claude-plugin/plugin.json +1 -1
  84. package/plugins/lisa-rails/.codex-plugin/plugin.json +1 -1
  85. package/plugins/lisa-rails-agy/plugin.json +1 -1
  86. package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json +1 -1
  87. package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json +1 -1
  88. package/plugins/lisa-typescript/.claude-plugin/plugin.json +1 -1
  89. package/plugins/lisa-typescript/.codex-plugin/plugin.json +1 -1
  90. package/plugins/lisa-typescript-agy/plugin.json +1 -1
  91. package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json +1 -1
  92. package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json +1 -1
  93. package/plugins/lisa-wiki/.claude-plugin/plugin.json +1 -1
  94. package/plugins/lisa-wiki/.codex-plugin/plugin.json +1 -1
  95. package/plugins/lisa-wiki-agy/plugin.json +1 -1
  96. package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json +1 -1
  97. package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json +1 -1
  98. package/plugins/src/base/rules/reference/config-resolution.md +43 -6
  99. package/plugins/src/base/skills/lisa-atlassian-access/SKILL.md +48 -6
  100. package/plugins/src/base/skills/lisa-jam-access/SKILL.md +38 -2
  101. package/plugins/src/base/skills/lisa-notion-access/SKILL.md +47 -6
  102. package/plugins/src/base/skills/lisa-posthog-access/SKILL.md +38 -2
  103. package/plugins/src/base/skills/lisa-sentry-access/SKILL.md +38 -2
  104. package/plugins/src/base/skills/lisa-setup-atlassian/SKILL.md +53 -7
  105. package/plugins/src/base/skills/lisa-setup-notion/SKILL.md +53 -7
  106. package/plugins/src/base/skills/lisa-sonarcloud-access/SKILL.md +49 -7
@@ -80,10 +80,43 @@ read_token() {
80
80
  # Preferred path: the single secrets chokepoint. It owns the one-store rule
81
81
  # and the surface ladder, so anything it can answer must not be read out of an
82
82
  # OS keychain here — a second reader is how the same credential ends up living
83
- # in two places and drifting. Keep this identical to `atlassian-access`.
83
+ # in two places and drifting. Keep the LADDER below identical to
84
+ # `atlassian-access`; the tail may differ, because this skill falls through to a
85
+ # legacy keychain rung and that one does not. Saying "the ladder" rather
86
+ # than "this function" is deliberate — the old wording asked for something
87
+ # unachievable, and an unachievable rule is one that gets quietly dropped.
88
+ #
89
+ # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
90
+ # lead because a project that vendors the resolver has declared which copy it
91
+ # wants used, and that decision must survive this change untouched. The plugin
92
+ # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
93
+ # pointing at it is reachable from anywhere the plugin itself is installed.
94
+ # Without one, a consumer repository that vendors none of the leading paths
95
+ # never reaches a resolver at all — the ladder exits without having asked
96
+ # anything, which is what pushed agents into improvising their own credential
97
+ # lookups. This LADDER is identical in every skill that resolves a credential
98
+ # and `credential-resolver-ladder` fails if any copy diverges. Only what
99
+ # happens AFTER the ladder may differ between them.
100
+ local candidates=(
101
+ .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
102
+ .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
103
+ .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
104
+ .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
105
+ )
106
+ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
107
+ candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
108
+ fi
109
+ if [ -n "${PLUGIN_ROOT:-}" ]; then
110
+ candidates+=("$PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
111
+ fi
112
+ # Last rung deliberately needs no environment variable: an agent that was
113
+ # never handed a plugin root still has the installed package to fall back on.
114
+ candidates+=(node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-secrets-access/scripts/resolve-secret.mjs)
115
+
84
116
  local resolver
85
- for resolver in .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs \
86
- .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs; do
117
+ local tried=()
118
+ for resolver in "${candidates[@]}"; do
119
+ tried+=("$resolver")
87
120
  if [ -f "$resolver" ]; then
88
121
  local via_lisa
89
122
  via_lisa=$(node "$resolver" get ATLASSIAN_API_TOKEN 2>/dev/null) \
@@ -94,15 +127,17 @@ read_token() {
94
127
  # Legacy fallback: the OS keychain written by the guided flow below, for
95
128
  # projects that have not adopted a credentials provider. Reached only when the
96
129
  # chokepoint is absent or has no entry.
130
+ local from_keychain=""
97
131
  case "$(uname -s)" in
98
- Darwin) security find-generic-password -s lisa-atlassian -a "$email" -w 2>/dev/null ;;
99
- Linux) command -v secret-tool >/dev/null && secret-tool lookup service lisa-atlassian account "$email" 2>/dev/null ;;
132
+ Darwin) from_keychain=$(security find-generic-password -s lisa-atlassian -a "$email" -w 2>/dev/null) ;;
133
+ Linux) command -v secret-tool >/dev/null && \
134
+ from_keychain=$(secret-tool lookup service lisa-atlassian account "$email" 2>/dev/null) ;;
100
135
  MINGW*|MSYS*|CYGWIN*)
101
136
  # `cmdkey /generic ... /pass:` stores the secret in Windows Credential Manager, but
102
137
  # `cmdkey /list` never prints stored passwords (by design). Read the CredentialBlob
103
138
  # back via the Win32 CredRead API through PowerShell; pass the target name via an env
104
139
  # var to dodge nested quoting, and strip the CRLF powershell.exe appends.
105
- LISA_CRED_TARGET="lisa-atlassian-${email}" powershell.exe -NoProfile -NonInteractive -Command '
140
+ from_keychain=$(LISA_CRED_TARGET="lisa-atlassian-${email}" powershell.exe -NoProfile -NonInteractive -Command '
106
141
  Add-Type -TypeDefinition @"
107
142
  using System;
108
143
  using System.Runtime.InteropServices;
@@ -128,8 +163,19 @@ public static class LisaCred {
128
163
  }
129
164
  }
130
165
  "@
131
- [LisaCred]::Read($env:LISA_CRED_TARGET)' 2>/dev/null | tr -d '\r' ;;
166
+ [LisaCred]::Read($env:LISA_CRED_TARGET)' 2>/dev/null | tr -d '\r') ;;
132
167
  esac
168
+ [ -n "$from_keychain" ] && { echo "$from_keychain"; return; }
169
+
170
+ # Name every path. A bare `return 1` sends the next reader hunting for a
171
+ # resolver they cannot see the absence of; the enumeration turns that into a
172
+ # seconds-long diagnosis. Paths and store coordinates only — never any
173
+ # resolved value, on any path.
174
+ echo "Error: could not resolve ATLASSIAN_API_TOKEN through lisa-secrets-access or the legacy keychain." >&2
175
+ echo "Tried, in order (relative paths are from $PWD):" >&2
176
+ printf ' %s\n' "${tried[@]}" >&2
177
+ echo " <OS keychain> service=lisa-atlassian account=$email" >&2
178
+ return 1
133
179
  }
134
180
 
135
181
  EXISTING=$(read_token "$EMAIL")
@@ -167,10 +167,43 @@ read_notion_token() {
167
167
  # Preferred path: the single secrets chokepoint. It owns the one-store rule
168
168
  # and the surface ladder, so anything it can answer must not be read out of an
169
169
  # OS keychain here — a second reader is how the same credential ends up living
170
- # in two places and drifting. Keep this identical to `notion-access`.
170
+ # in two places and drifting. Keep the LADDER below identical to
171
+ # `notion-access`; the tail may differ, because this skill falls through to a
172
+ # legacy keychain rung and that one does not. Saying "the ladder" rather
173
+ # than "this function" is deliberate — the old wording asked for something
174
+ # unachievable, and an unachievable rule is one that gets quietly dropped.
175
+ #
176
+ # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
177
+ # lead because a project that vendors the resolver has declared which copy it
178
+ # wants used, and that decision must survive this change untouched. The plugin
179
+ # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
180
+ # pointing at it is reachable from anywhere the plugin itself is installed.
181
+ # Without one, a consumer repository that vendors none of the leading paths
182
+ # never reaches a resolver at all — the ladder exits without having asked
183
+ # anything, which is what pushed agents into improvising their own credential
184
+ # lookups. This LADDER is identical in every skill that resolves a credential
185
+ # and `credential-resolver-ladder` fails if any copy diverges. Only what
186
+ # happens AFTER the ladder may differ between them.
187
+ local candidates=(
188
+ .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
189
+ .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
190
+ .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
191
+ .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
192
+ )
193
+ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
194
+ candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
195
+ fi
196
+ if [ -n "${PLUGIN_ROOT:-}" ]; then
197
+ candidates+=("$PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
198
+ fi
199
+ # Last rung deliberately needs no environment variable: an agent that was
200
+ # never handed a plugin root still has the installed package to fall back on.
201
+ candidates+=(node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-secrets-access/scripts/resolve-secret.mjs)
202
+
171
203
  local resolver
172
- for resolver in .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs \
173
- .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs; do
204
+ local tried=()
205
+ for resolver in "${candidates[@]}"; do
206
+ tried+=("$resolver")
174
207
  if [ -f "$resolver" ]; then
175
208
  local via_lisa
176
209
  via_lisa=$(node "$resolver" get NOTION_API_TOKEN 2>/dev/null) \
@@ -181,15 +214,17 @@ read_notion_token() {
181
214
  # Legacy fallback: the OS keychain written by the guided flow below, for
182
215
  # projects that have not adopted a credentials provider. Reached only when the
183
216
  # chokepoint is absent or has no entry.
217
+ local from_keychain=""
184
218
  case "$(uname -s)" in
185
- Darwin) security find-generic-password -s lisa-notion -a "$workspace" -w 2>/dev/null ;;
186
- Linux) command -v secret-tool >/dev/null && secret-tool lookup service lisa-notion account "$workspace" 2>/dev/null ;;
219
+ Darwin) from_keychain=$(security find-generic-password -s lisa-notion -a "$workspace" -w 2>/dev/null) ;;
220
+ Linux) command -v secret-tool >/dev/null && \
221
+ from_keychain=$(secret-tool lookup service lisa-notion account "$workspace" 2>/dev/null) ;;
187
222
  MINGW*|MSYS*|CYGWIN*)
188
223
  # `cmdkey /generic ... /pass:` stores the secret in Windows Credential Manager, but
189
224
  # `cmdkey /list` never prints stored passwords (by design). Read the CredentialBlob
190
225
  # back via the Win32 CredRead API through PowerShell; pass the target name via an env
191
226
  # var to dodge nested quoting, and strip the CRLF powershell.exe appends.
192
- LISA_CRED_TARGET="lisa-notion-${workspace}" powershell.exe -NoProfile -NonInteractive -Command '
227
+ from_keychain=$(LISA_CRED_TARGET="lisa-notion-${workspace}" powershell.exe -NoProfile -NonInteractive -Command '
193
228
  Add-Type -TypeDefinition @"
194
229
  using System;
195
230
  using System.Runtime.InteropServices;
@@ -215,8 +250,19 @@ public static class LisaCred {
215
250
  }
216
251
  }
217
252
  "@
218
- [LisaCred]::Read($env:LISA_CRED_TARGET)' 2>/dev/null | tr -d '\r' ;;
253
+ [LisaCred]::Read($env:LISA_CRED_TARGET)' 2>/dev/null | tr -d '\r') ;;
219
254
  esac
255
+ [ -n "$from_keychain" ] && { echo "$from_keychain"; return; }
256
+
257
+ # Name every path. A bare `return 1` sends the next reader hunting for a
258
+ # resolver they cannot see the absence of; the enumeration turns that into a
259
+ # seconds-long diagnosis. Paths and store coordinates only — never any
260
+ # resolved value, on any path.
261
+ echo "Error: could not resolve NOTION_API_TOKEN through lisa-secrets-access or the legacy keychain." >&2
262
+ echo "Tried, in order (relative paths are from $PWD):" >&2
263
+ printf ' %s\n' "${tried[@]}" >&2
264
+ echo " <OS keychain> service=lisa-notion account=$workspace" >&2
265
+ return 1
220
266
  }
221
267
 
222
268
  TOKEN=$(read_notion_token "$WORKSPACE")
@@ -62,9 +62,38 @@ not the only one:
62
62
  read_sonar_secret() {
63
63
  local name="$1"
64
64
  [ -n "${!name:-}" ] && { echo "${!name}"; return; }
65
+ #
66
+ # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
67
+ # lead because a project that vendors the resolver has declared which copy it
68
+ # wants used, and that decision must survive this change untouched. The plugin
69
+ # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
70
+ # pointing at it is reachable from anywhere the plugin itself is installed.
71
+ # Without one, a consumer repository that vendors none of the leading paths
72
+ # never reaches a resolver at all — the ladder exits without having asked
73
+ # anything, which is what pushed agents into improvising their own credential
74
+ # lookups. This LADDER is identical in every skill that resolves a credential
75
+ # and `credential-resolver-ladder` fails if any copy diverges. Only what
76
+ # happens AFTER the ladder may differ between them.
77
+ local candidates=(
78
+ .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
79
+ .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
80
+ .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
81
+ .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
82
+ )
83
+ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
84
+ candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
85
+ fi
86
+ if [ -n "${PLUGIN_ROOT:-}" ]; then
87
+ candidates+=("$PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
88
+ fi
89
+ # Last rung deliberately needs no environment variable: an agent that was
90
+ # never handed a plugin root still has the installed package to fall back on.
91
+ candidates+=(node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-secrets-access/scripts/resolve-secret.mjs)
92
+
65
93
  local resolver
66
- for resolver in .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs \
67
- .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs; do
94
+ local tried=()
95
+ for resolver in "${candidates[@]}"; do
96
+ tried+=("$resolver")
68
97
  if [ -f "$resolver" ]; then
69
98
  local via_lisa
70
99
  via_lisa=$(node "$resolver" get "$name" 2>/dev/null) \
@@ -72,6 +101,13 @@ read_sonar_secret() {
72
101
  break
73
102
  fi
74
103
  done
104
+ # Name every path. A bare `return 1` sends the next reader hunting for a
105
+ # resolver they cannot see the absence of; the enumeration turns that into a
106
+ # seconds-long diagnosis. Paths and store coordinates only — never any
107
+ # resolved value, on any path.
108
+ echo "Error: could not resolve $name through lisa-secrets-access." >&2
109
+ echo "Tried, in order (relative paths are from $PWD):" >&2
110
+ printf ' %s\n' "${tried[@]}" >&2
75
111
  return 1
76
112
  }
77
113
 
@@ -81,11 +117,17 @@ SONARQUBE_CLI_TOKEN=$(read_sonar_secret SONARQUBE_CLI_TOKEN) && export SONARQUBE
81
117
  SONARQUBE_CLI_ORG=$(read_sonar_secret SONARQUBE_CLI_ORG) && export SONARQUBE_CLI_ORG
82
118
  ```
83
119
 
84
- `sonar-secrets.sh` runs the same resolution with a longer search path (it also
85
- probes `.codex/skills/…` and `node_modules/@codyswann/lisa/plugins/lisa/…`,
86
- because a hook fires in checkouts that never installed an agent plugin) and with
87
- a timeout, because it sits in front of every prompt. Use its search order
88
- verbatim when this skill runs inside a hook.
120
+ `sonar-secrets.sh` runs the same resolution with two differences that belong to
121
+ a hook rather than to a skill: it anchors every candidate at `$repo_root` (a
122
+ hook fires from whatever directory the agent happens to be in) and it wraps the
123
+ `resolve-secret.mjs` call in a timeout, because it sits in front of every
124
+ prompt. Use its search order verbatim when this skill runs inside a hook.
125
+
126
+ This paragraph used to claim the hook searched a *longer* path than the ladder
127
+ above. It did — the ladder above stopped after `.agents/`, so in a checkout
128
+ that vendored neither leading path it reached no resolver at all and returned
129
+ without a word. The two now cover the same layouts, and the fix that closed
130
+ that gap is guarded by `credential-resolver-ladder`.
89
131
 
90
132
  Wiring is performed once by `/lisa:setup:sonar` (which drives `sonar integrate
91
133
  <agent>`); this access layer assumes the MCP is already wired. This is distinct
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "NestJS-specific skills and migration write-protection hooks.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-typescript",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-typescript",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-typescript",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-typescript",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-typescript",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-wiki",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-wiki",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-wiki",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-wiki",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-wiki",
3
- "version": "4.13.1",
3
+ "version": "4.13.2",
4
4
  "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"