@codyswann/lisa 4.22.11 → 4.22.13

package/plugins/lisa/.codex-plugin/skills/lisa-tracker-sync/SKILL.md

@@ -37,11 +37,11 @@ Two consequences the vendor arms must not restate differently:
 Resolve roles through the shared resolver rather than an inlined helper:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/scripts/resolve-lifecycle-role.mjs" \
+node "${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/resolve-lifecycle-role.mjs" \
   --role <role> --vendor <jira|linear|github> --intent <read|write> [--env <env>]
 ```
 
-Exit `0` with a value means configured; exit `0` with **empty** output means an optional role is unset — skip the transition; exit `2` means a required role is unset or a write was refused a fallback value.
+Exit `0` with a value means configured; exit `0` with **empty** output means an optional role is unset — skip the transition; exit `2` means a required role is unset or a write was refused a fallback value. Any other exit is a resolver failure, never an unset role.
 
 If `$ARGUMENTS` is empty, all vendor skills auto-detect a ticket reference from the active plan file (most recently modified `.md` in `plans/`).
 

package/plugins/lisa/hooks/block-no-verify.sh

@@ -23,7 +23,7 @@
 # Add a name here in the same commit that closes a vector. A hardening that
 # forgets to is invisible to refresh, and shows up as an unexplained diff at
 # review time instead of a named capability.
-# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, git-config-parameters-append, git-config-parameters-expansion, heredoc-shell-word, herestring-aware, no-verify-short
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, git-config-parameters-append, git-config-parameters-expansion, heredoc-shell-word, herestring-aware, no-verify-short, nested-shell-no-verify
 #
 # Shell-token matching avoids false positives from issue bodies, heredocs, and
 # commit-message prose while still catching quoted real argv values such as
@@ -216,6 +216,9 @@ COMMAND_SEPARATORS = {
     ";", "|", "||", "&", "&&", "(", ")", "<", ">", ">>", "<<", "&|",
 }
 
+SHELL_PROGRAMS = {"bash", "dash", "ksh", "sh", "zsh"}
+MAX_SHELL_NESTING = 8
+
 # git's own options that take a SEPARATE value token, which therefore must be
 # skipped when looking for the subcommand: `git -c core.hooksPath=x commit` and
 # `git -C /repo commit` both reach `commit`.
@@ -333,6 +336,8 @@ def commit_bypasses_verification(argv):
         if token.startswith("--"):
             if token in COMMIT_LONG_SEPARATE_VALUE:
                 index += 1
+            elif disables_verification(token):
+                return True
             continue
         # A bare `-` is git's stdin placeholder, not an option cluster.
         if not token.startswith("-") or token == "-":
@@ -366,11 +371,25 @@ def subcommand_after_git(tokens, start):
     return None
 
 
-def git_commit_skips_verification(text):
+def shell_starts_command(tokens, index):
+    """Whether a recognized shell token occupies command position."""
+    start = index - 1
+    while start >= 0 and tokens[start] not in COMMAND_SEPARATORS:
+        start -= 1
+    prefix = tokens[start + 1:index]
+    if not prefix:
+        return True
+    if prefix[0] == "env":
+        prefix = prefix[1:]
+    return all("=" in token and not token.startswith("=") for token in prefix)
+
+
+def git_commit_skips_verification(text, depth=0):
     """Whether the command runs `git commit` with the short `-n` bypass.
 
     Args:
         text: The command line, heredoc payloads already stripped.
+        depth: Number of recognized shell payloads already traversed.
 
     Returns:
         True if any `git commit` invocation on the line skips verification.
@@ -387,6 +406,28 @@ def git_commit_skips_verification(text):
         found = subcommand_after_git(scoped_tokens, index + 1)
         if found and found[0] == "commit" and commit_bypasses_verification(found[1]):
             return True
+    if depth >= MAX_SHELL_NESTING:
+        return False
+    for index, token in enumerate(scoped_tokens):
+        program = token.rsplit("/", 1)[-1]
+        if program not in SHELL_PROGRAMS or not shell_starts_command(
+            scoped_tokens, index
+        ):
+            continue
+        cursor = index + 1
+        while cursor < len(scoped_tokens):
+            option = scoped_tokens[cursor]
+            if option in COMMAND_SEPARATORS or not option.startswith("-"):
+                break
+            cursor += 1
+            if "c" not in option[1:]:
+                continue
+            if cursor >= len(scoped_tokens):
+                break
+            payload = scoped_tokens[cursor]
+            if git_commit_skips_verification(payload, depth + 1):
+                return True
+            break
     return False
 
 

package/plugins/lisa/hooks/parity-safety-net.sh

@@ -724,6 +724,10 @@ classify_rm_target() {
       set +f
       block "recursive forced delete of the current directory (rm -rf .)"
       ;;
+    .git | .git/* | */.git | */.git/*)
+      set +f
+      block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it)"
+      ;;
     .. | ../* | */.. | */../*)
       set +f
       block "recursive forced delete of a path outside the project (.. traversal)"
@@ -1031,11 +1035,16 @@ fi
 # purpose, and blocking those would be the collision that gets a guard switched
 # off. The trailing `([/[:space:]'"$qc"']|$)` is what draws that line.
 readonly GIT_CONTROL_PLANE='(^|[[:space:]='"$qc"'./])\.git([/[:space:]'"$qc"']|$)'
-if matches_cs "$RM_RF_CLUSTER" || matches_cs "$RM_RF_SPLIT"; then
-  if matches_cs "$GIT_CONTROL_PLANE"; then
+while IFS= read -r git_stmt; do
+  [ -n "$git_stmt" ] || continue
+  if ! scan -E "$git_stmt" "$RM_RF_CLUSTER" \
+    && ! scan -E "$git_stmt" "$RM_RF_SPLIT"; then
+    continue
+  fi
+  if scan -E "$git_stmt" "$GIT_CONTROL_PLANE"; then
     block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it). Delete a specific ignored artifact instead, or re-clone if the checkout is genuinely to be discarded."
   fi
-fi
+done <<< "$(printf '%s' "$normalized_command_str" | tr '&|;' '\n')"
 
 # 15. Credential stores. Reading one into an agent transcript is disclosure even
 # when nothing is copied anywhere: the value lands in a log, a context window,
@@ -1077,14 +1086,19 @@ has_private_dotenv_path() {
     | grep -Eio -- '(^|[[:space:]='"$qc"'./])\.env(\.[[:alnum:]_-]+)?')" \
     || dotenv_scan_status=$?
   if [ "$dotenv_scan_status" -gt 1 ]; then
-    block "dotenv path classification failed; denying the credential-store read fail-closed."
+    scan_failed "$dotenv_scan_status"
   fi
 
   while IFS= read -r candidate; do
     [ -n "$candidate" ] || continue
+    dotenv_normalize_status=0
     candidate="$(printf '%s' "$candidate" \
       | tr '[:upper:]' '[:lower:]' \
-      | grep -Eo -- '\.env(\.[[:alnum:]_-]+)?')"
+      | grep -Eo -- '\.env(\.[[:alnum:]_-]+)?')" \
+      || dotenv_normalize_status=$?
+    if [ "$dotenv_normalize_status" -gt 1 ] || [ -z "$candidate" ]; then
+      scan_failed "$dotenv_normalize_status"
+    fi
     case "$candidate" in
       .env.example | .env.sample | .env.template | .env.dist | .env.schema | .env.defaults) ;;
       *) return 0 ;;

package/plugins/lisa/hooks/threshold-ratchet-families.mjs

@@ -79,7 +79,7 @@ export const FAMILIES = [
   },
   {
     id: "lighthouse",
-    match: /(^|\/)lighthouserc-config\.json$/,
+    match: /(^|\/)(?:lighthouserc-config|lighthouserc|\.lighthouserc)\.json$/,
     kind: "lighthouse",
   },
 ];
@@ -98,6 +98,8 @@ export const LIGHTHOUSE_ASSERTION_DIRECTIONS = Object.freeze({
   maxLength: "max",
 });
 
+const LIGHTHOUSE_LEVELS = Object.freeze({ off: 0, warn: 1, error: 2 });
+
 /**
  * Extract numeric Lighthouse assertions with a direction chosen per key.
  *
@@ -133,6 +135,13 @@ export function extractLighthouseAssertions(conf) {
     return out;
   }
   for (const [audit, spec] of Object.entries(assertions)) {
+    const level = Array.isArray(spec) ? spec[0] : spec;
+    if (typeof level === "string" && Object.hasOwn(LIGHTHOUSE_LEVELS, level)) {
+      out.set(`${audit}.$level`, {
+        value: LIGHTHOUSE_LEVELS[level],
+        direction: "min",
+      });
+    }
     const options =
       Array.isArray(spec) &&
       spec.length >= 2 &&

package/plugins/lisa/rules/reference/config-resolution.md

@@ -909,10 +909,6 @@ read_notion_token() {
   if [ -n "${PLUGIN_ROOT:-}" ]; then
     candidates+=("$PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
-  # Last rung deliberately needs no environment variable: an agent that was
-  # never handed a plugin root still has the installed package to fall back on.
-  candidates+=(node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-secrets-access/scripts/resolve-secret.mjs)
-
   local resolver
   local tried=()
   for resolver in "${candidates[@]}"; do

package/plugins/lisa/rules/reference/leaf-only-lifecycle.md

@@ -83,7 +83,7 @@ Notes:
 
 ### Classifying a hold
 
-`rollup-blocker-classification` (`plugins/src/base/scripts/rollup-blocker-classification.mjs`) is the single implementation. It takes the child graph the vendor reader already produced and returns, per held leaf, a class and the actor who must clear it:
+`rollup-blocker-classification` (`scripts/rollup-blocker-classification.mjs` under the active Lisa plugin root) is the single installed implementation. It takes the child graph the vendor reader already produced and returns, per held leaf, a class and the actor who must clear it:
 
 | Class | Recorded signal on the leaf | Who must act | Clears on its own? |
 |---|---|---|---|

package/plugins/lisa/scripts/resolve-lifecycle-role.mjs

@@ -94,6 +94,9 @@ export const VENDOR_ROOTS = Object.freeze({
   github: "github.labels.build",
 });
 
+/** GitHub's PRD lifecycle is a separate required role map from build work. */
+const GITHUB_PRD_PREFIX = "prd.";
+
 /** Resolution outcomes, reported so a caller never has to guess what happened. */
 export const OUTCOMES = Object.freeze({
   CONFIGURED: "configured",
@@ -170,7 +173,12 @@ export const resolveRole = ({
   global: globalConfig,
   fallback,
 }) => {
-  const root = VENDOR_ROOTS[vendor];
+  let root = VENDOR_ROOTS[vendor];
+  let configuredRole = role;
+  if (vendor === "github" && role.startsWith(GITHUB_PRD_PREFIX)) {
+    root = "github.labels.prd";
+    configuredRole = role.slice(GITHUB_PRD_PREFIX.length);
+  }
   if (!root) {
     return {
       value: "",
@@ -182,7 +190,9 @@ export const resolveRole = ({
 
   // `done` is env-keyed on every vendor; an env selects one rung of the map.
   const path =
-    env && role === "done" ? `${root}.done.${env}` : `${root}.${role}`;
+    env && configuredRole === "done"
+      ? `${root}.done.${env}`
+      : `${root}.${configuredRole}`;
 
   for (const [label, source] of [
     ["local", local],
@@ -199,7 +209,9 @@ export const resolveRole = ({
     }
   }
 
-  const optional = OPTIONAL_ROLES.includes(role);
+  const optional =
+    !role.startsWith(GITHUB_PRD_PREFIX) &&
+    OPTIONAL_ROLES.includes(configuredRole);
 
   // R2 — a fallback may inform a read, never supply a write target.
   if (fallback && intent === "write") {

package/plugins/lisa/skills/lisa-github-build-intake/SKILL.md

@@ -36,18 +36,17 @@ selection-only: never assign or reassign issues as part of build intake.
 Build-queue label names are read from `.lisa.config.json` `github.labels.build.*`, falling back to defaults documented in the `config-resolution` rule. Bash pattern:
 
 ```bash
-# Read role with default fallback. Local overrides global per-key.
 read_role() {
   # Single resolver — see config-resolution "The single resolver".
-  # Exit 0 + empty output means an OPTIONAL role is unset: skip that transition,
-  # never substitute the second argument. A default on an optional role is what
-  # made "unset" indistinguishable from "not customized".
-  node "${CLAUDE_PLUGIN_ROOT}/scripts/resolve-lifecycle-role.mjs" \
-    --role "$1" --vendor github --intent "${3:-read}" 2>/dev/null
+  local value
+  value=$(node "${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/resolve-lifecycle-role.mjs" \
+    --role "$1" --vendor github --intent "${2:-read}") || return $?
+  [ -n "$value" ] || { echo "Error: required GitHub role '$1' resolved empty." >&2; return 2; }
+  printf '%s\n' "$value"
 }
 
-READY=$(read_role ready "status:ready")
-CLAIMED=$(read_role claimed "status:in-progress")
+READY=$(read_role ready read) || exit $?
+CLAIMED=$(read_role claimed write) || exit $?
 
 read_intake_assignee() {
   local cli_value local_v

package/plugins/lisa/skills/lisa-github-prd-intake/SKILL.md

@@ -19,21 +19,20 @@ Run one intake cycle against that repo. The first eligible issue with the `ready
 PRD label names are read from `.lisa.config.json` `github.labels.prd.*`, falling back to defaults documented in the `config-resolution` rule. Bash pattern:
 
 ```bash
-# Read role with default fallback. Local overrides global per-key.
 read_role() {
   # Single resolver — see config-resolution "The single resolver".
-  # Exit 0 + empty output means an OPTIONAL role is unset: skip that transition,
-  # never substitute the second argument. A default on an optional role is what
-  # made "unset" indistinguishable from "not customized".
-  node "${CLAUDE_PLUGIN_ROOT}/scripts/resolve-lifecycle-role.mjs" \
-    --role "$1" --vendor github --intent "${3:-read}" 2>/dev/null
+  local value
+  value=$(node "${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/resolve-lifecycle-role.mjs" \
+    --role "$1" --vendor github --intent "${2:-write}") || return $?
+  [ -n "$value" ] || { echo "Error: required GitHub PRD role '$1' resolved empty." >&2; return 2; }
+  printf '%s\n' "$value"
 }
 
-READY=$(read_role ready "prd-ready")
-IN_REVIEW=$(read_role in_review "prd-in-review")
-BLOCKED=$(read_role blocked "prd-blocked")
-TICKETED=$(read_role ticketed "prd-ticketed")
-SHIPPED=$(read_role shipped "prd-shipped")
+READY=$(read_role prd.ready write) || exit $?
+IN_REVIEW=$(read_role prd.in_review write) || exit $?
+BLOCKED=$(read_role prd.blocked write) || exit $?
+TICKETED=$(read_role prd.ticketed write) || exit $?
+SHIPPED=$(read_role prd.shipped write) || exit $?
 ```
 
 In prose below, the role names refer to the resolved labels: e.g. "the `ready` label" means whatever `github.labels.prd.ready` resolves to (default: `prd-ready`).

package/plugins/lisa/skills/lisa-github-sync/SKILL.md

@@ -129,7 +129,7 @@ classifier absent.
 
 **Single-environment collapse (this repo).** `.lisa.config.json` `deploy.branches` declares only `production: main`, so the env-keyed `done` resolves to the single label `status:done` — there is no `status:on-dev` / `status:on-stg` and **no dev → staging → prod promotion chain**. Resolve the env rungs via the env-keyed `done` logic in `config-resolution`, but in the single-environment case the only rung is production and it collapses to the one `status:done` value; the rollup never attempts to resolve a dev or staging `done`. Projects that DO have multiple environments keep the env-keyed map and roll the parent up to whichever `done` (including intermediate `status:on-dev`/`status:on-stg`) its leaves have collectively reached.
 
-**Apply the derived label** (only when it differs from the parent's current `status:*`): remove the parent's existing `status:*` label and add the derived one, keeping exactly one `status:*` label so the build-queue invariant holds. Post an idempotent `[claude-sync] rollup` comment naming the derived state and the child tally (e.g. `3/4 leaves terminal, 1 blocked → status:blocked`); when the derived state is `status:blocked` the comment also carries the classifier's per-class section, so the blocking child and its actor are one read rather than a descent. Skip the comment if an identical one is already the most recent rollup comment — the classifier's fingerprint is the dedupe key, and an unchanged verdict is not re-posted.
+**Apply the derived label** (only when it differs from the parent's current `status:*`): remove the parent's existing `status:*` label and add the derived one, keeping exactly one `status:*` label so the build-queue invariant holds. Re-read the labels immediately after the edit and require exactly one `status:*`; if the count differs, surface an error and stop without trying to normalize the ambiguous set automatically. Post an idempotent `[claude-sync] rollup` comment naming the derived state and the child tally (e.g. `3/4 leaves terminal, 1 blocked → status:blocked`); when the derived state is `status:blocked` the comment also carries the classifier's per-class section, so the blocking child and its actor are one read rather than a descent. Use the classifier's `change.summary` as the dedupe key and skip the comment when that summary is unchanged.
 
 ```bash
 gh issue edit <parent-number> --repo <org>/<repo> \

package/plugins/lisa/skills/lisa-github-write-prd/SKILL.md

@@ -22,21 +22,23 @@ REPO=$(jq -r '.github.repo // empty' .lisa.config.local.json 2>/dev/null); REPO=
 
 read_role() {
   # Single resolver — see config-resolution "The single resolver".
-  # Exit 0 + empty output means an OPTIONAL role is unset: skip that transition,
-  # never substitute the second argument. A default on an optional role is what
-  # made "unset" indistinguishable from "not customized".
-  node "${CLAUDE_PLUGIN_ROOT}/scripts/resolve-lifecycle-role.mjs" \
-    --role "$1" --vendor github --intent "${3:-read}" 2>/dev/null
+  # Every PRD role used here is required. Resolver errors remain visible, and
+  # an empty result is refused rather than passed to `gh --label`.
+  local value
+  value=$(node "${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/resolve-lifecycle-role.mjs" \
+    --role "$1" --vendor github --intent "${2:-write}") || return $?
+  [ -n "$value" ] || { echo "Error: required GitHub role '$1' resolved empty." >&2; return 2; }
+  printf '%s\n' "$value"
 }
 # Resolve the FULL PRD lifecycle vocabulary from config (never hard-code names) — needed so the
 # "exactly one role" reconcile and the past-ready check work for projects that renamed any label.
-PRD_DRAFT=$(read_role '.github.labels.prd.draft' 'prd-draft')
-PRD_READY=$(read_role '.github.labels.prd.ready' 'prd-ready')
-PRD_IN_REVIEW=$(read_role '.github.labels.prd.in_review' 'prd-in-review')
-PRD_BLOCKED=$(read_role '.github.labels.prd.blocked' 'prd-blocked')
-PRD_TICKETED=$(read_role '.github.labels.prd.ticketed' 'prd-ticketed')
-PRD_SHIPPED=$(read_role '.github.labels.prd.shipped' 'prd-shipped')
-PRD_VERIFIED=$(read_role '.github.labels.prd.verified' 'prd-verified')
+PRD_DRAFT=$(read_role prd.draft write) || exit $?
+PRD_READY=$(read_role prd.ready write) || exit $?
+PRD_IN_REVIEW=$(read_role prd.in_review write) || exit $?
+PRD_BLOCKED=$(read_role prd.blocked write) || exit $?
+PRD_TICKETED=$(read_role prd.ticketed write) || exit $?
+PRD_SHIPPED=$(read_role prd.shipped write) || exit $?
+PRD_VERIFIED=$(read_role prd.verified write) || exit $?
 # All lifecycle labels (for one-of reconcile) and the "progressed past ready" set (never down-rank):
 ALL_PRD_LABELS=("$PRD_DRAFT" "$PRD_READY" "$PRD_IN_REVIEW" "$PRD_BLOCKED" "$PRD_TICKETED" "$PRD_SHIPPED" "$PRD_VERIFIED")
 PROGRESSED=("$PRD_IN_REVIEW" "$PRD_BLOCKED" "$PRD_TICKETED" "$PRD_SHIPPED" "$PRD_VERIFIED")

package/plugins/lisa/skills/lisa-jira-build-intake/SKILL.md

@@ -20,18 +20,17 @@ Run one build-intake cycle. The first eligible ready ticket is claimed, built vi
 Status names are read from `.lisa.config.json` `jira.workflow.*`, falling back to defaults documented in the `config-resolution` rule. Bash pattern:
 
 ```bash
-# Read role with default fallback. Local overrides global per-key.
 read_role() {
   # Single resolver — see config-resolution "The single resolver".
-  # Exit 0 + empty output means an OPTIONAL role is unset: skip that transition,
-  # never substitute the second argument. A default on an optional role is what
-  # made "unset" indistinguishable from "not customized".
-  node "${CLAUDE_PLUGIN_ROOT}/scripts/resolve-lifecycle-role.mjs" \
-    --role "$1" --vendor jira --intent "${3:-read}" 2>/dev/null
+  local value
+  value=$(node "${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/resolve-lifecycle-role.mjs" \
+    --role "$1" --vendor jira --intent "${2:-read}") || return $?
+  [ -n "$value" ] || { echo "Error: required JIRA role '$1' resolved empty." >&2; return 2; }
+  printf '%s\n' "$value"
 }
 
-READY=$(read_role ready "Ready")
-CLAIMED=$(read_role claimed "In Progress")
+READY=$(read_role ready read) || exit $?
+CLAIMED=$(read_role claimed write) || exit $?
 ```
 
 For env-keyed `done`, resolve the env first, then look up `done[<env>]`:

package/plugins/lisa/skills/lisa-jira-journey/scripts/parse-plan.py

@@ -33,6 +33,7 @@ import sys
 import urllib.request
 from base64 import b64encode
 from pathlib import Path
+from urllib.parse import urlsplit
 
 
 # Intentionally matches the exact local-claim prefixes only. EVIDENCE-REF is a
@@ -66,13 +67,50 @@ def jira_config_candidates():
     return candidates
 
 
+def read_jira_config(config_path):
+    """Read the server and login fields from one jira-cli config."""
+    server = ""
+    login = ""
+    with open(config_path) as config:
+        for line in config:
+            if line.startswith("server:"):
+                server = line.split(":", 1)[1].strip()
+            elif line.startswith("login:"):
+                login = line.split(":", 1)[1].strip()
+    return server, login
+
+
+def server_origin(server):
+    """Return the normalized HTTPS origin used as the credential trust key."""
+    try:
+        parsed = urlsplit(server)
+        port = parsed.port
+    except ValueError:
+        return ""
+    if parsed.scheme.lower() != "https" or not parsed.hostname:
+        return ""
+    authority = parsed.hostname.lower()
+    if port and port != 443:
+        authority = f"{authority}:{port}"
+    return f"https://{authority}"
+
+
 def resolve_jira_config_path():
-    """Resolve the first existing project config, then the home fallback."""
+    """Resolve a project config only when its host matches a user trust root."""
     candidates = jira_config_candidates()
-    for candidate in candidates:
-        if candidate.exists():
+    home_config = candidates[-1]
+    trusted_server = os.environ.get("JIRA_SERVER", "").strip()
+    if not trusted_server and home_config.exists():
+        trusted_server, _ = read_jira_config(home_config)
+    trusted_origin = server_origin(trusted_server)
+
+    for candidate in candidates[:-1]:
+        if not candidate.exists():
+            continue
+        candidate_server, _ = read_jira_config(candidate)
+        if trusted_origin and server_origin(candidate_server) == trusted_origin:
             return candidate
-    return candidates[-1]
+    return home_config
 
 
 def get_jira_config():
@@ -82,14 +120,18 @@ def get_jira_config():
         print(f"ERROR: jira-cli config not found at {config_path}", file=sys.stderr)
         sys.exit(1)
 
-    server = ""
-    login = ""
-    with open(config_path) as f:
-        for line in f:
-            if line.startswith("server:"):
-                server = line.split(":", 1)[1].strip()
-            elif line.startswith("login:"):
-                login = line.split(":", 1)[1].strip()
+    server, login = read_jira_config(config_path)
+
+    trusted_server = os.environ.get("JIRA_SERVER", "").strip()
+    trusted_origin = server_origin(trusted_server)
+    if trusted_origin:
+        if server_origin(server) != trusted_origin:
+            print("ERROR: jira-cli config server does not match trusted JIRA_SERVER", file=sys.stderr)
+            sys.exit(1)
+        server = trusted_server.rstrip("/")
+    if not server_origin(server):
+        print("ERROR: JIRA server must be an HTTPS URL from a trusted config", file=sys.stderr)
+        sys.exit(1)
 
     token = os.environ.get("JIRA_API_TOKEN", "")
     if not token:

package/plugins/lisa/skills/lisa-linear-build-intake/SKILL.md

@@ -21,20 +21,19 @@ This skill is the destination of the `lisa-tracker-build-intake` shim when `trac
 Build-queue **workflow state** names are read from `.lisa.config.json` `linear.workflow.*`, falling back to defaults documented in the `config-resolution` rule. Bash pattern:
 
 ```bash
-# Read role with default fallback. Local overrides global per-key.
 read_role() {
   # Single resolver — see config-resolution "The single resolver".
   # Exit 0 + empty output means an OPTIONAL role is unset: skip that transition,
-  # never substitute the second argument. A default on an optional role is what
-  # made "unset" indistinguishable from "not customized".
-  node "${CLAUDE_PLUGIN_ROOT}/scripts/resolve-lifecycle-role.mjs" \
-    --role "$1" --vendor linear --intent "${3:-read}" 2>/dev/null
+  # never substitute a default. Any non-zero status is a resolver failure and
+  # remains visible to the caller.
+  node "${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/resolve-lifecycle-role.mjs" \
+    --role "$1" --vendor linear --intent "${2:-read}"
 }
 
-READY=$(read_role ready "Ready")
-CLAIMED=$(read_role claimed "In Progress")
-REVIEW=$(read_role review "In Review")
-BLOCKED=$(read_role blocked "Blocked")
+READY=$(read_role ready read) || exit $?
+CLAIMED=$(read_role claimed write) || exit $?
+REVIEW=$(read_role review write) || exit $?
+BLOCKED=$(read_role blocked read) || exit $?
 ```
 
 For env-keyed `done`, resolve the env first, then look up `done[<env>]`:
@@ -69,7 +68,7 @@ else
 fi
 ```
 
-In prose below, the role names refer to the resolved **states**: e.g. "the `ready` state" means whatever `linear.workflow.ready` resolves to (default: `Ready`).
+In prose below, the role names refer to the configured **states**: e.g. "the `ready` state" means whatever `linear.workflow.ready` resolves to. Required roles must be configured; optional roles carry no default.
 
 ## Why native states, not labels
 

package/plugins/lisa/skills/lisa-linear-evidence/SKILL.md

@@ -109,6 +109,6 @@ Return:
 ## Rules
 
 - Never modify the Issue description as part of evidence posting — comments only. Description edits go through `lisa-linear-write-issue`.
-- Never skip the label transition. The build queue is keyed off the configured `linear.workflow.*` labels; an item that ships without transitioning is invisible to monitoring.
+- Never skip the transition when `review` is configured. An empty `$REVIEW` is the one sanctioned skip (Phase 5): post the evidence comment, leave the Issue in `$CLAIMED`, and report the skip. Whenever `$REVIEW` is non-empty, the configured native state transition is mandatory.
 - If `lisa-linear-access operation: save-comment` fails, retry once. If it fails again, surface the error — don't pretend the comment was posted.
 - Do not delete prior comments. The history is the audit trail.

package/plugins/lisa/skills/lisa-linear-sync/SKILL.md

@@ -152,7 +152,7 @@ When the caller passes `--rollup`, this skill **derives a parent/container's wor
 
 ## Rules
 
-- Never transition a leaf Issue's workflow `state` from this skill at all. `--rollup` (parent derivation, per the `leaf-only-lifecycle` rule) is the only write path that remains; every other milestone SUGGESTS a transition in its comment and nothing more. The state is the lifecycle lane, so a write here would move the item in the build queue.
+- Never transition a leaf Issue's workflow `state` from this skill except for the narrowly defined Phase 4b backstop that reopens a leaf auto-closed at an intermediate environment. `--rollup` remains the only other write path (parent derivation, per the `leaf-only-lifecycle` rule); every normal milestone SUGGESTS a transition in its comment and nothing more. The state is the lifecycle lane, so an unscoped write here would move the item in the build queue.
 - Never resolve a role by searching the team's states. Only a name the project configured may be written; a `type`- or position-derived match may inform a read and must never supply a write target (`config-resolution`, R2).
 - Rollup derives a *parent's* workflow state from its children and never rolls a parent into the human-owned ready lane (never `$READY`). It cites the `leaf-only-lifecycle` rule by slug rather than restating the state machine.
 - Never post empty or minimal comments — if a milestone has no meaningful content, skip the post.

package/plugins/lisa/skills/lisa-repair-intake/SKILL.md

@@ -728,7 +728,8 @@ node "${CLAUDE_PLUGIN_ROOT}/scripts/rollup-blocker-classification.mjs" \
    report already asks a person to decide.
 
 3. **If the derived state differs from the parent's current state, apply it** via the vendor's
-   lifecycle write (JIRA transition, GitHub/Linear label swap keeping exactly one `status:*`),
+   lifecycle write: a JIRA transition; a GitHub label swap keeping exactly one `status:*`; or a
+   Linear `save-issue` update that writes the resolved workflow `stateId`, never a lifecycle label.
    removing any conflicting stale build lifecycle role — **including a stale `ready`** the parent
    should never carry. Post an idempotent `[lisa-repair-intake]` rollup note naming the derived
    state and the child tally (honor the backoff window + fingerprint). Include that exact rendered

package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -131,6 +131,7 @@ export function probe(name, exec = boundedChildOutput) {
     return { present: true, version: extractVersion(out) };
   } catch (err) {
     if (err.code === "ENOENT") return { present: false, version: null };
+    if (err.code === "ETIMEDOUT") throw err;
     const output = `${err.stdout ?? ""}${err.stderr ?? ""}`;
     return { present: true, version: extractVersion(output) };
   }
@@ -808,9 +809,9 @@ export function installUserSessionHook(repoRoot, options = {}) {
   const dir = join(home, ".claude");
   const settingsPath = join(dir, "settings.json");
   // Settings stores shell source, so the absolute path still needs quoting.
-  // JSON string syntax is accepted by the shell for ordinary path text and
-  // safely escapes spaces, quotes, dollars and backticks.
-  const command = `bash ${JSON.stringify(script)}`;
+  // Single quotes suppress parameter expansion and command substitution. An
+  // embedded quote closes, escapes, and reopens the quoted shell word.
+  const command = `bash '${script.replaceAll("'", `'\\''`)}'`;
 
   let settings = {};
   if (exists(settingsPath)) {

package/plugins/lisa/skills/lisa-tracker-sync/SKILL.md

@@ -37,11 +37,11 @@ Two consequences the vendor arms must not restate differently:
 Resolve roles through the shared resolver rather than an inlined helper:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/scripts/resolve-lifecycle-role.mjs" \
+node "${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/resolve-lifecycle-role.mjs" \
   --role <role> --vendor <jira|linear|github> --intent <read|write> [--env <env>]
 ```
 
-Exit `0` with a value means configured; exit `0` with **empty** output means an optional role is unset — skip the transition; exit `2` means a required role is unset or a write was refused a fallback value.
+Exit `0` with a value means configured; exit `0` with **empty** output means an optional role is unset — skip the transition; exit `2` means a required role is unset or a write was refused a fallback value. Any other exit is a resolver failure, never an unset role.
 
 If `$ARGUMENTS` is empty, all vendor skills auto-detect a ticket reference from the active plan file (most recently modified `.md` in `plans/`).