@codyswann/lisa 4.21.4 → 4.21.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/doctor-nightly-e2e-guard-command-files.d.ts +19 -0
- package/dist/cli/doctor-nightly-e2e-guard-command-files.d.ts.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-command-files.js +221 -0
- package/dist/cli/doctor-nightly-e2e-guard-command-files.js.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-contract.d.ts +113 -0
- package/dist/cli/doctor-nightly-e2e-guard-contract.d.ts.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-contract.js +87 -0
- package/dist/cli/doctor-nightly-e2e-guard-contract.js.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-deadline.d.ts +61 -0
- package/dist/cli/doctor-nightly-e2e-guard-deadline.d.ts.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-deadline.js +97 -0
- package/dist/cli/doctor-nightly-e2e-guard-deadline.js.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-evidence.d.ts +52 -0
- package/dist/cli/doctor-nightly-e2e-guard-evidence.d.ts.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-evidence.js +68 -0
- package/dist/cli/doctor-nightly-e2e-guard-evidence.js.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-graph.d.ts +14 -0
- package/dist/cli/doctor-nightly-e2e-guard-graph.d.ts.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-graph.js +130 -0
- package/dist/cli/doctor-nightly-e2e-guard-graph.js.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-io.d.ts +41 -0
- package/dist/cli/doctor-nightly-e2e-guard-io.d.ts.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-io.js +239 -0
- package/dist/cli/doctor-nightly-e2e-guard-io.js.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-job.d.ts +31 -0
- package/dist/cli/doctor-nightly-e2e-guard-job.d.ts.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-job.js +156 -0
- package/dist/cli/doctor-nightly-e2e-guard-job.js.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-proof.d.ts +42 -0
- package/dist/cli/doctor-nightly-e2e-guard-proof.d.ts.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-proof.js +57 -0
- package/dist/cli/doctor-nightly-e2e-guard-proof.js.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-remediation.d.ts +32 -0
- package/dist/cli/doctor-nightly-e2e-guard-remediation.d.ts.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-remediation.js +55 -0
- package/dist/cli/doctor-nightly-e2e-guard-remediation.js.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-runtime.d.ts +34 -0
- package/dist/cli/doctor-nightly-e2e-guard-runtime.d.ts.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-runtime.js +93 -0
- package/dist/cli/doctor-nightly-e2e-guard-runtime.js.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-scan.d.ts +17 -0
- package/dist/cli/doctor-nightly-e2e-guard-scan.d.ts.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-scan.js +86 -0
- package/dist/cli/doctor-nightly-e2e-guard-scan.js.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-shell-lexer.d.ts +38 -0
- package/dist/cli/doctor-nightly-e2e-guard-shell-lexer.d.ts.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-shell-lexer.js +160 -0
- package/dist/cli/doctor-nightly-e2e-guard-shell-lexer.js.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-shell.d.ts +40 -0
- package/dist/cli/doctor-nightly-e2e-guard-shell.d.ts.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard-shell.js +201 -0
- package/dist/cli/doctor-nightly-e2e-guard-shell.js.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard.d.ts +36 -0
- package/dist/cli/doctor-nightly-e2e-guard.d.ts.map +1 -0
- package/dist/cli/doctor-nightly-e2e-guard.js +186 -0
- package/dist/cli/doctor-nightly-e2e-guard.js.map +1 -0
- package/dist/cli/doctor.d.ts.map +1 -1
- package/dist/cli/doctor.js +7 -0
- package/dist/cli/doctor.js.map +1 -1
- package/dist/core/nightly-e2e-guard-behavior-certificate.d.ts +25 -0
- package/dist/core/nightly-e2e-guard-behavior-certificate.d.ts.map +1 -0
- package/dist/core/nightly-e2e-guard-behavior-certificate.js +30 -0
- package/dist/core/nightly-e2e-guard-behavior-certificate.js.map +1 -0
- package/dist/core/upstream-evidence-manifest.d.ts.map +1 -1
- package/dist/core/upstream-evidence-manifest.js +30 -3
- package/dist/core/upstream-evidence-manifest.js.map +1 -1
- package/package.json +5 -3
- package/plugins/lisa/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs +17 -2
- package/plugins/lisa/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs +17 -2
- package/plugins/lisa-agy/plugin.json +1 -1
- package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs +17 -2
- package/plugins/lisa-cdk/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-agy/plugin.json +1 -1
- package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs +17 -2
- package/plugins/lisa-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs +17 -2
- package/plugins/lisa-expo/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-agy/plugin.json +1 -1
- package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-agy/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-agy/plugin.json +1 -1
- package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-agy/plugin.json +1 -1
- package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser-agy/plugin.json +1 -1
- package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-agy/plugin.json +1 -1
- package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-agy/plugin.json +1 -1
- package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-agy/plugin.json +1 -1
- package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/src/base/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs +17 -2
- package/scripts/check-derived-artifacts.mjs +32 -5
- package/scripts/generate-nightly-e2e-guard-certificate.mjs +370 -0
- package/scripts/two-channel-couplings.json +16 -4
package/package.json
CHANGED
|
@@ -48,9 +48,11 @@
|
|
|
48
48
|
"check:upstream-evidence-manifest": "node scripts/generate-upstream-evidence-manifest.mjs --check",
|
|
49
49
|
"build:lisa-owned-hash-ledger": "node scripts/generate-lisa-owned-hash-ledger.mjs",
|
|
50
50
|
"check:lisa-owned-hash-ledger": "node scripts/generate-lisa-owned-hash-ledger.mjs --check",
|
|
51
|
+
"build:nightly-guard-certificate": "node scripts/generate-nightly-e2e-guard-certificate.mjs",
|
|
52
|
+
"check:nightly-guard-certificate": "node scripts/generate-nightly-e2e-guard-certificate.mjs --check",
|
|
51
53
|
"generate:two-channel-couplings": "bun scripts/generate-two-channel-couplings.ts",
|
|
52
54
|
"check:two-channel-couplings": "bun scripts/generate-two-channel-couplings.ts --check",
|
|
53
|
-
"check:artifacts": "status=0; bun run check:upstream-evidence-manifest || status=1; bun run check:lisa-owned-hash-ledger || status=1; bun run check:two-channel-couplings || status=1; exit $status",
|
|
55
|
+
"check:artifacts": "status=0; bun run check:upstream-evidence-manifest || status=1; bun run check:lisa-owned-hash-ledger || status=1; bun run check:nightly-guard-certificate || status=1; bun run check:two-channel-couplings || status=1; exit $status",
|
|
54
56
|
"refresh:upstream-public-commits": "node scripts/generate-upstream-evidence-manifest.mjs --refresh-public-commits",
|
|
55
57
|
"check:rules-pairing": "bash scripts/check-rules-pairing.sh",
|
|
56
58
|
"check:pipeline-status-reads": "node scripts/check-pipeline-status-reads.mjs",
|
|
@@ -159,7 +161,7 @@
|
|
|
159
161
|
"zod-validation-error": "^4.0.0"
|
|
160
162
|
},
|
|
161
163
|
"name": "@codyswann/lisa",
|
|
162
|
-
"version": "4.21.
|
|
164
|
+
"version": "4.21.6",
|
|
163
165
|
"description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
|
|
164
166
|
"main": "dist/index.js",
|
|
165
167
|
"exports": {
|
|
@@ -298,5 +300,5 @@
|
|
|
298
300
|
"vite": "^8.0.16"
|
|
299
301
|
},
|
|
300
302
|
"type": "module",
|
|
301
|
-
"lisaReleaseCommit": "
|
|
303
|
+
"lisaReleaseCommit": "d17bab15edc316cce82f3f4cd0593810242b3395"
|
|
302
304
|
}
|
package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs
CHANGED
|
@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
|
|
|
126
126
|
env.AWS_SECRET_ACCESS_KEY = String(
|
|
127
127
|
bundle.secretAccessKey ?? bundle.aws_secret_access_key
|
|
128
128
|
);
|
|
129
|
+
// STS verification must reach AWS, not an endpoint inherited from the host.
|
|
130
|
+
// A redirected endpoint could otherwise answer the probe and turn a green
|
|
131
|
+
// result into evidence about a local emulator or an attacker-controlled URL.
|
|
132
|
+
env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
|
|
129
133
|
env.AWS_PAGER = "";
|
|
130
134
|
return env;
|
|
131
135
|
}
|
|
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
|
|
|
228
232
|
* Restore the previous provider value and prove the restoration.
|
|
229
233
|
* @param {object} cfg Resolved configuration.
|
|
230
234
|
* @param {{id: string, value: string}} previous Previous entry.
|
|
235
|
+
* @param {string} candidateRaw Exact value written by this publication.
|
|
231
236
|
* @param {Function} fetch Provider reader.
|
|
232
237
|
* @param {Function} write Provider writer.
|
|
233
238
|
* @returns {string} Human-readable rollback outcome with no secret material.
|
|
234
239
|
*/
|
|
235
|
-
function rollback(cfg, previous, fetch, write) {
|
|
240
|
+
function rollback(cfg, previous, candidateRaw, fetch, write) {
|
|
236
241
|
try {
|
|
242
|
+
const current = currentEntry(cfg, fetch);
|
|
243
|
+
if (current.value !== candidateRaw) {
|
|
244
|
+
return "rollback skipped because the provider changed after this publication";
|
|
245
|
+
}
|
|
237
246
|
write(cfg, previous.id, previous.value);
|
|
238
247
|
const restored = currentEntry(cfg, fetch);
|
|
239
248
|
if (restored.value !== previous.value) {
|
|
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
|
|
|
288
297
|
} catch (error) {
|
|
289
298
|
const reason =
|
|
290
299
|
error instanceof Error ? error.message.split("\n")[0] : String(error);
|
|
291
|
-
const rollbackOutcome = rollback(
|
|
300
|
+
const rollbackOutcome = rollback(
|
|
301
|
+
cfg,
|
|
302
|
+
previous,
|
|
303
|
+
candidate.raw,
|
|
304
|
+
fetch,
|
|
305
|
+
write
|
|
306
|
+
);
|
|
292
307
|
throw new Error(
|
|
293
308
|
`${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
|
|
294
309
|
);
|
|
@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
|
|
|
126
126
|
env.AWS_SECRET_ACCESS_KEY = String(
|
|
127
127
|
bundle.secretAccessKey ?? bundle.aws_secret_access_key
|
|
128
128
|
);
|
|
129
|
+
// STS verification must reach AWS, not an endpoint inherited from the host.
|
|
130
|
+
// A redirected endpoint could otherwise answer the probe and turn a green
|
|
131
|
+
// result into evidence about a local emulator or an attacker-controlled URL.
|
|
132
|
+
env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
|
|
129
133
|
env.AWS_PAGER = "";
|
|
130
134
|
return env;
|
|
131
135
|
}
|
|
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
|
|
|
228
232
|
* Restore the previous provider value and prove the restoration.
|
|
229
233
|
* @param {object} cfg Resolved configuration.
|
|
230
234
|
* @param {{id: string, value: string}} previous Previous entry.
|
|
235
|
+
* @param {string} candidateRaw Exact value written by this publication.
|
|
231
236
|
* @param {Function} fetch Provider reader.
|
|
232
237
|
* @param {Function} write Provider writer.
|
|
233
238
|
* @returns {string} Human-readable rollback outcome with no secret material.
|
|
234
239
|
*/
|
|
235
|
-
function rollback(cfg, previous, fetch, write) {
|
|
240
|
+
function rollback(cfg, previous, candidateRaw, fetch, write) {
|
|
236
241
|
try {
|
|
242
|
+
const current = currentEntry(cfg, fetch);
|
|
243
|
+
if (current.value !== candidateRaw) {
|
|
244
|
+
return "rollback skipped because the provider changed after this publication";
|
|
245
|
+
}
|
|
237
246
|
write(cfg, previous.id, previous.value);
|
|
238
247
|
const restored = currentEntry(cfg, fetch);
|
|
239
248
|
if (restored.value !== previous.value) {
|
|
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
|
|
|
288
297
|
} catch (error) {
|
|
289
298
|
const reason =
|
|
290
299
|
error instanceof Error ? error.message.split("\n")[0] : String(error);
|
|
291
|
-
const rollbackOutcome = rollback(
|
|
300
|
+
const rollbackOutcome = rollback(
|
|
301
|
+
cfg,
|
|
302
|
+
previous,
|
|
303
|
+
candidate.raw,
|
|
304
|
+
fetch,
|
|
305
|
+
write
|
|
306
|
+
);
|
|
292
307
|
throw new Error(
|
|
293
308
|
`${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
|
|
294
309
|
);
|
|
@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
|
|
|
126
126
|
env.AWS_SECRET_ACCESS_KEY = String(
|
|
127
127
|
bundle.secretAccessKey ?? bundle.aws_secret_access_key
|
|
128
128
|
);
|
|
129
|
+
// STS verification must reach AWS, not an endpoint inherited from the host.
|
|
130
|
+
// A redirected endpoint could otherwise answer the probe and turn a green
|
|
131
|
+
// result into evidence about a local emulator or an attacker-controlled URL.
|
|
132
|
+
env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
|
|
129
133
|
env.AWS_PAGER = "";
|
|
130
134
|
return env;
|
|
131
135
|
}
|
|
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
|
|
|
228
232
|
* Restore the previous provider value and prove the restoration.
|
|
229
233
|
* @param {object} cfg Resolved configuration.
|
|
230
234
|
* @param {{id: string, value: string}} previous Previous entry.
|
|
235
|
+
* @param {string} candidateRaw Exact value written by this publication.
|
|
231
236
|
* @param {Function} fetch Provider reader.
|
|
232
237
|
* @param {Function} write Provider writer.
|
|
233
238
|
* @returns {string} Human-readable rollback outcome with no secret material.
|
|
234
239
|
*/
|
|
235
|
-
function rollback(cfg, previous, fetch, write) {
|
|
240
|
+
function rollback(cfg, previous, candidateRaw, fetch, write) {
|
|
236
241
|
try {
|
|
242
|
+
const current = currentEntry(cfg, fetch);
|
|
243
|
+
if (current.value !== candidateRaw) {
|
|
244
|
+
return "rollback skipped because the provider changed after this publication";
|
|
245
|
+
}
|
|
237
246
|
write(cfg, previous.id, previous.value);
|
|
238
247
|
const restored = currentEntry(cfg, fetch);
|
|
239
248
|
if (restored.value !== previous.value) {
|
|
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
|
|
|
288
297
|
} catch (error) {
|
|
289
298
|
const reason =
|
|
290
299
|
error instanceof Error ? error.message.split("\n")[0] : String(error);
|
|
291
|
-
const rollbackOutcome = rollback(
|
|
300
|
+
const rollbackOutcome = rollback(
|
|
301
|
+
cfg,
|
|
302
|
+
previous,
|
|
303
|
+
candidate.raw,
|
|
304
|
+
fetch,
|
|
305
|
+
write
|
|
306
|
+
);
|
|
292
307
|
throw new Error(
|
|
293
308
|
`${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
|
|
294
309
|
);
|
|
@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
|
|
|
126
126
|
env.AWS_SECRET_ACCESS_KEY = String(
|
|
127
127
|
bundle.secretAccessKey ?? bundle.aws_secret_access_key
|
|
128
128
|
);
|
|
129
|
+
// STS verification must reach AWS, not an endpoint inherited from the host.
|
|
130
|
+
// A redirected endpoint could otherwise answer the probe and turn a green
|
|
131
|
+
// result into evidence about a local emulator or an attacker-controlled URL.
|
|
132
|
+
env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
|
|
129
133
|
env.AWS_PAGER = "";
|
|
130
134
|
return env;
|
|
131
135
|
}
|
|
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
|
|
|
228
232
|
* Restore the previous provider value and prove the restoration.
|
|
229
233
|
* @param {object} cfg Resolved configuration.
|
|
230
234
|
* @param {{id: string, value: string}} previous Previous entry.
|
|
235
|
+
* @param {string} candidateRaw Exact value written by this publication.
|
|
231
236
|
* @param {Function} fetch Provider reader.
|
|
232
237
|
* @param {Function} write Provider writer.
|
|
233
238
|
* @returns {string} Human-readable rollback outcome with no secret material.
|
|
234
239
|
*/
|
|
235
|
-
function rollback(cfg, previous, fetch, write) {
|
|
240
|
+
function rollback(cfg, previous, candidateRaw, fetch, write) {
|
|
236
241
|
try {
|
|
242
|
+
const current = currentEntry(cfg, fetch);
|
|
243
|
+
if (current.value !== candidateRaw) {
|
|
244
|
+
return "rollback skipped because the provider changed after this publication";
|
|
245
|
+
}
|
|
237
246
|
write(cfg, previous.id, previous.value);
|
|
238
247
|
const restored = currentEntry(cfg, fetch);
|
|
239
248
|
if (restored.value !== previous.value) {
|
|
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
|
|
|
288
297
|
} catch (error) {
|
|
289
298
|
const reason =
|
|
290
299
|
error instanceof Error ? error.message.split("\n")[0] : String(error);
|
|
291
|
-
const rollbackOutcome = rollback(
|
|
300
|
+
const rollbackOutcome = rollback(
|
|
301
|
+
cfg,
|
|
302
|
+
previous,
|
|
303
|
+
candidate.raw,
|
|
304
|
+
fetch,
|
|
305
|
+
write
|
|
306
|
+
);
|
|
292
307
|
throw new Error(
|
|
293
308
|
`${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
|
|
294
309
|
);
|
|
@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
|
|
|
126
126
|
env.AWS_SECRET_ACCESS_KEY = String(
|
|
127
127
|
bundle.secretAccessKey ?? bundle.aws_secret_access_key
|
|
128
128
|
);
|
|
129
|
+
// STS verification must reach AWS, not an endpoint inherited from the host.
|
|
130
|
+
// A redirected endpoint could otherwise answer the probe and turn a green
|
|
131
|
+
// result into evidence about a local emulator or an attacker-controlled URL.
|
|
132
|
+
env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
|
|
129
133
|
env.AWS_PAGER = "";
|
|
130
134
|
return env;
|
|
131
135
|
}
|
|
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
|
|
|
228
232
|
* Restore the previous provider value and prove the restoration.
|
|
229
233
|
* @param {object} cfg Resolved configuration.
|
|
230
234
|
* @param {{id: string, value: string}} previous Previous entry.
|
|
235
|
+
* @param {string} candidateRaw Exact value written by this publication.
|
|
231
236
|
* @param {Function} fetch Provider reader.
|
|
232
237
|
* @param {Function} write Provider writer.
|
|
233
238
|
* @returns {string} Human-readable rollback outcome with no secret material.
|
|
234
239
|
*/
|
|
235
|
-
function rollback(cfg, previous, fetch, write) {
|
|
240
|
+
function rollback(cfg, previous, candidateRaw, fetch, write) {
|
|
236
241
|
try {
|
|
242
|
+
const current = currentEntry(cfg, fetch);
|
|
243
|
+
if (current.value !== candidateRaw) {
|
|
244
|
+
return "rollback skipped because the provider changed after this publication";
|
|
245
|
+
}
|
|
237
246
|
write(cfg, previous.id, previous.value);
|
|
238
247
|
const restored = currentEntry(cfg, fetch);
|
|
239
248
|
if (restored.value !== previous.value) {
|
|
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
|
|
|
288
297
|
} catch (error) {
|
|
289
298
|
const reason =
|
|
290
299
|
error instanceof Error ? error.message.split("\n")[0] : String(error);
|
|
291
|
-
const rollbackOutcome = rollback(
|
|
300
|
+
const rollbackOutcome = rollback(
|
|
301
|
+
cfg,
|
|
302
|
+
previous,
|
|
303
|
+
candidate.raw,
|
|
304
|
+
fetch,
|
|
305
|
+
write
|
|
306
|
+
);
|
|
292
307
|
throw new Error(
|
|
293
308
|
`${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
|
|
294
309
|
);
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "4.21.
|
|
3
|
+
"version": "4.21.6",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "4.21.
|
|
3
|
+
"version": "4.21.6",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "4.21.
|
|
3
|
+
"version": "4.21.6",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "4.21.
|
|
3
|
+
"version": "4.21.6",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "4.21.
|
|
3
|
+
"version": "4.21.6",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|