@codyswann/lisa 4.22.9 → 4.22.10

package/plugins/lisa/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -161,12 +161,16 @@ function stripFamilyBlocks(text, family) {
     const opened = findFamily(out, start);
     if (opened.index === -1) return out;
     const closed = findFamily(out, end, opened.index + opened.length);
-    // A truncated block (opened, never closed) would otherwise swallow the rest
-    // of the file on every subsequent write.
-    const after =
-      closed.index === -1
-        ? ""
-        : out.slice(closed.index + closed.length).replace(/^\n/, "");
+    // A truncated block (opened, never closed) is not safe to interpret. Any
+    // guessed boundary could delete operator-authored content after the marker,
+    // so refuse before the caller writes and preserve the original byte-for-byte.
+    if (closed.index === -1) {
+      throw new Error(
+        `Refusing to rewrite a managed ${family} block with no closing marker. ` +
+          `Repair the marker pair first; no file was changed.`
+      );
+    }
+    const after = out.slice(closed.index + closed.length).replace(/^\n/, "");
     out = `${out.slice(0, opened.index)}${after}`;
   }
 }

package/plugins/lisa/skills/lisa-sentry-access/SKILL.md

@@ -48,9 +48,9 @@ interactively and headlessly — which is why it leads. The REST tier uses:
 read_sentry_token() {
   [ -n "${SENTRY_AUTH_TOKEN:-}" ] && { echo "$SENTRY_AUTH_TOKEN"; return; }
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -59,12 +59,9 @@ read_sentry_token() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -83,7 +80,7 @@ read_sentry_token() {
       local via_lisa
       via_lisa=$(node "$resolver" get SENTRY_AUTH_TOKEN 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Name every path. A bare `return 1` sends the next reader hunting for a

package/plugins/lisa/skills/lisa-setup-atlassian/SKILL.md

@@ -86,9 +86,9 @@ read_token() {
   # than "this function" is deliberate — the old wording asked for something
   # unachievable, and an unachievable rule is one that gets quietly dropped.
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -97,12 +97,9 @@ read_token() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -121,7 +118,7 @@ read_token() {
       local via_lisa
       via_lisa=$(node "$resolver" get ATLASSIAN_API_TOKEN 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Legacy fallback: the OS keychain written by the guided flow below, for

package/plugins/lisa/skills/lisa-setup-linear/SKILL.md

@@ -104,17 +104,14 @@ read_linear_key() {  # $1=workspace slug
   # `linear-access` grew to seven, leaving `/lisa:setup:linear` unable to reach
   # a key that `lisa-linear-access` could read from the same repository.
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used. The plugin rungs are the floor: `resolve-secret.mjs` ships
-  # beside this skill, so a rung pointing at it is reachable from anywhere the
-  # plugin itself is installed.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
+  # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
+  # pointing at it is reachable from anywhere the plugin itself is installed.
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -133,7 +130,7 @@ read_linear_key() {  # $1=workspace slug
       local via_lisa
       via_lisa=$(node "$resolver" get LINEAR_API_KEY 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Legacy fallback: the OS keychain written by the guided flow below, for

package/plugins/lisa/skills/lisa-setup-notion/SKILL.md

@@ -173,9 +173,9 @@ read_notion_token() {
   # than "this function" is deliberate — the old wording asked for something
   # unachievable, and an unachievable rule is one that gets quietly dropped.
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -184,12 +184,9 @@ read_notion_token() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -208,7 +205,7 @@ read_notion_token() {
       local via_lisa
       via_lisa=$(node "$resolver" get NOTION_API_TOKEN 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Legacy fallback: the OS keychain written by the guided flow below, for

package/plugins/lisa/skills/lisa-setup-remote-aws/SKILL.md

@@ -64,13 +64,18 @@ The lock remains held through rollback and its deletion is verified before the
 command reports success:
 
 ```bash
-aws --profile shared secretsmanager get-secret-value \
-  --secret-id remote-agent-credentials \
+aws secretsmanager get-secret-value \
+  --secret-id <selected-secret-name> \
   --query SecretString \
   --output text \
   | node .claude/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs publish
 ```
 
+Use the same secret name passed to `--secret-name`; the default is
+`remote-agent-credentials`. Add `--profile <source-profile>` only when the
+operator's ambient AWS identity cannot read the emission and the project names
+a source profile. A named `shared` profile is not otherwise required.
+
 Resolve the script from the installed runtime or `node_modules` when the
 `.claude/skills` copy is not present. Never print or place the candidate in an
 argument or temporary file. A CDK deployment followed later by a human copy is

package/plugins/lisa/skills/lisa-setup-remote-env/SKILL.md

@@ -97,9 +97,14 @@ A surface that **re-runs this script when a container resumes** — Codex Cloud
 A surface that **skips this script whenever a filesystem cache exists** — Claude Code web — must not. Materializing here would write the values once and then never refresh them, so a credential rotated on Tuesday would still be serving Monday's value until the cache expired days later. Those surfaces materialize from a session-start hook instead, which runs every session including a resumed one:
 
 ```sh
-bash scripts/lisa-remote-env/session-start.sh   # guard; reruns toolchain, secrets, then hook
+bash "$CLAUDE_PROJECT_DIR/scripts/lisa-remote-env/session-start.sh"   # project-scoped absolute hook
 ```
 
+The installer also registers a user-scoped hook using the checkout's resolved
+absolute path. If invoking this asset by hand, either use that absolute path or
+change to the repository root first; a bare checkout-relative command is not a
+portable session-start configuration.
+
 The selection comes from the surface's `materializeAt` capability in `lisa-secrets-access`, not from its name, so adding a surface does not mean editing a branch. The hook is committed to the repository, so it also fires on a developer's machine — it exits `0` immediately there rather than failing, because a correct local session must not look broken.
 
 ## Detect before you provision

package/plugins/lisa/skills/lisa-setup-remote-env/assets/session-start.sh

@@ -46,8 +46,27 @@ here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 # SessionStart hosts are fail-open, so they surface that result and still allow
 # the agent session to continue.
 bash "${here}/setup.sh" --phase=toolchain "$@"
+
+# The toolchain child cannot export into this parent shell. Its durable output
+# is linked into ~/.local/bin, so make that directory visible before the next
+# child tries to execute the provider CLI it just installed.
+case ":$PATH:" in
+  *":$HOME/.local/bin:"*) ;;
+  *) PATH="$HOME/.local/bin:$PATH"; export PATH ;;
+esac
+
 bash "${here}/setup.sh" --phase=secrets "$@"
 
+# Materialization writes a Lisa-owned block into .profile that sources the
+# generated environment and removes ambient AWS credential poison. The project
+# hook is another non-login child, so load that block here and let the child
+# inherit the exact environment materialization just produced.
+if [ -r "$HOME/.profile" ]; then
+  # The materializer owns this runtime path.
+  # shellcheck disable=SC1090
+  . "$HOME/.profile"
+fi
+
 # A project hook is part of the remote toolchain contract too. It covers tools
 # that cannot be expressed by the pinned manifest, so skipping it on a cached
 # session can leave fresh credentials with no client capable of using them.

package/plugins/lisa/skills/lisa-setup-remote-env/assets/setup.sh

@@ -132,6 +132,7 @@ for candidate in \
   ".claude/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   ".agents/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   ".codex/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
+  ".opencode/skills/lisa/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   "plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   "node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs"; do
   if [ -f "$candidate" ]; then

package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -51,7 +51,10 @@ import { pathDirs } from "../../lisa-setup-workstation/scripts/catalogue.mjs";
 
 import { assertPinned, extractVersion, planToolchain } from "./toolchain.mjs";
 
-import { boundedChildOutput } from "../../lisa-setup-workstation/scripts/bounded-child.mjs";
+import {
+  boundedChildOutput,
+  SETUP_OPERATION_BUDGET_MS,
+} from "../../lisa-setup-workstation/scripts/bounded-child.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -173,12 +176,14 @@ function installReleaseZip(tool, binDir) {
     const archive = join(temporary, "download.zip");
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", archive], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Verify before unpacking, not after. An unexpected archive must fail
     // before any of its contents reach a directory that is on PATH.
     verifyChecksum(archive, tool.sha256, tool.name);
     boundedChildOutput("unzip", ["-q", "-o", archive, "-d", temporary], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     const binary = join(temporary, tool.binary ?? tool.name);
     boundedChildOutput(
@@ -186,6 +191,7 @@ function installReleaseZip(tool, binDir) {
       ["-m", "0755", binary, join(binDir, tool.name)],
       {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       }
     );
   } finally {
@@ -210,10 +216,12 @@ function installReleaseTar(tool, binDir) {
     const archive = join(temporary, "download.tar.gz");
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", archive], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     verifyChecksum(archive, tool.sha256, tool.name);
     boundedChildOutput("tar", ["-xzf", archive, "-C", temporary], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Release tarballs usually nest under a versioned directory, so `binary` is
     // a path within the archive rather than a bare name.
@@ -223,6 +231,7 @@ function installReleaseTar(tool, binDir) {
       ["-m", "0755", binary, join(binDir, tool.name)],
       {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       }
     );
   } finally {
@@ -272,6 +281,7 @@ function installReleaseTree(tool, binDir) {
     const archive = join(temporary, "download.archive");
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", archive], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Verify before unpacking, as everywhere else here: an unexpected archive
     // must fail before any of its contents reach the filesystem.
@@ -285,10 +295,12 @@ function installReleaseTree(tool, binDir) {
     if (tool.url.endsWith(".zip")) {
       boundedChildOutput("unzip", ["-q", "-o", archive, "-d", prefix], {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       });
     } else {
       boundedChildOutput("tar", ["-xzf", archive, "-C", prefix], {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       });
     }
 
@@ -342,6 +354,7 @@ function installReleaseBinary(tool, binDir) {
     const artifact = join(temporary, tool.name);
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", artifact], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Verify before it reaches a directory on PATH. For this kind that ordering
     // matters more than for the archives: the downloaded file is directly
@@ -353,6 +366,7 @@ function installReleaseBinary(tool, binDir) {
       ["-m", "0755", artifact, join(binDir, tool.name)],
       {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       }
     );
   } finally {
@@ -370,6 +384,7 @@ function installNpmGlobal(tool) {
     ["install", "--global", `${tool.package}@${tool.version}`],
     {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     }
   );
 }
@@ -509,7 +524,10 @@ function runHook(hook, dryRun) {
   console.log(`\nProject hook: ${hook}`);
   if (dryRun) return;
   chmodSync(path, 0o755);
-  boundedChildOutput("bash", [path], { stdio: "inherit" });
+  boundedChildOutput("bash", [path], {
+    stdio: "inherit",
+    timeout: SETUP_OPERATION_BUDGET_MS,
+  });
 }
 
 /** Phases this runner can execute, in the order they must happen. */
@@ -789,7 +807,10 @@ export function installUserSessionHook(repoRoot, options = {}) {
 
   const dir = join(home, ".claude");
   const settingsPath = join(dir, "settings.json");
-  const command = `bash ${script}`;
+  // Settings stores shell source, so the absolute path still needs quoting.
+  // JSON string syntax is accepted by the shell for ordinary path text and
+  // safely escapes spaces, quotes, dollars and backticks.
+  const command = `bash ${JSON.stringify(script)}`;
 
   let settings = {};
   if (exists(settingsPath)) {
@@ -1506,7 +1527,7 @@ async function main() {
       boundedChildOutput(
         "node",
         dryRun ? [materialize, "--dry-run"] : [materialize],
-        { stdio: "inherit" }
+        { stdio: "inherit", timeout: SETUP_OPERATION_BUDGET_MS }
       );
     } catch (err) {
       if (!retried) throw err;

package/plugins/lisa/skills/lisa-setup-workstation/scripts/bounded-child.mjs

@@ -83,6 +83,15 @@ import { execFileSync, spawnSync } from "node:child_process";
  */
 export const CHILD_BUDGET_MS = 30_000;
 
+/**
+ * Deadline for setup operations that legitimately include downloads, package
+ * installation, secret-provider calls, or a project-declared hook.
+ *
+ * Kept separate from {@link CHILD_BUDGET_MS}: probes should still fail quickly,
+ * while a cold network install must not be killed by the probe budget.
+ */
+export const SETUP_OPERATION_BUDGET_MS = 10 * 60_000;
+
 /**
  * Whether this value is a child that was killed at its deadline.
  *

package/plugins/lisa/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -36,7 +36,10 @@
 import { existsSync, lstatSync, mkdirSync, rmSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
 
-import { boundedChildOutput } from "./bounded-child.mjs";
+import {
+  boundedChildOutput,
+  SETUP_OPERATION_BUDGET_MS,
+} from "./bounded-child.mjs";
 
 import {
   AGENTS,
@@ -387,7 +390,9 @@ export function installEntry(entry, row, deps = {}) {
 
   try {
     if (entry.kind === "npm-global") {
-      run("npm", ["install", "-g", entry.package]);
+      run("npm", ["install", "-g", entry.package], {
+        timeout: SETUP_OPERATION_BUDGET_MS,
+      });
     } else if (entry.kind === "vendor-script") {
       if (!entry.script) {
         return {
@@ -410,12 +415,11 @@ export function installEntry(entry, row, deps = {}) {
       // exit status is the SHELL's, not curl's, so a 404 feeds an empty script
       // to bash, bash exits 0, and a tool that was never installed is reported
       // as installed. That is exactly what `sonarsource.com/install` did.
-      run("bash", [
-        "-o",
-        "pipefail",
-        "-c",
-        `curl -fsSL ${entry.script} | bash`,
-      ]);
+      run(
+        "bash",
+        ["-o", "pipefail", "-c", `curl -fsSL ${entry.script} | bash`],
+        { timeout: SETUP_OPERATION_BUDGET_MS }
+      );
     } else if (entry.kind === "aws-cli") {
       // macOS ships a .pkg that wants an administrator, which a headless run
       // has no business prompting for. Reported as manual with the one-line
@@ -436,20 +440,24 @@ export function installEntry(entry, row, deps = {}) {
       const url = `https://awscli.amazonaws.com/awscli-exe-linux-${
         process.arch === "arm64" ? "aarch64" : "x86_64"
       }.zip`;
-      run("bash", [
-        "-o",
-        "pipefail",
-        "-c",
+      run(
+        "bash",
         [
-          "set -e",
-          'tmp="$(mktemp -d)"',
-          `curl -fsSL "${url}" -o "$tmp/awscli.zip"`,
-          'unzip -q "$tmp/awscli.zip" -d "$tmp"',
-          `"$tmp/aws/install" --install-dir "${home}/.local/aws-cli" ` +
-            `--bin-dir "${home}/.local/bin" --update`,
-          'rm -rf "$tmp"',
-        ].join("\n"),
-      ]);
+          "-o",
+          "pipefail",
+          "-c",
+          [
+            "set -e",
+            'tmp="$(mktemp -d)"',
+            `curl -fsSL "${url}" -o "$tmp/awscli.zip"`,
+            'unzip -q "$tmp/awscli.zip" -d "$tmp"',
+            `"$tmp/aws/install" --install-dir "${home}/.local/aws-cli" ` +
+              `--bin-dir "${home}/.local/bin" --update`,
+            'rm -rf "$tmp"',
+          ].join("\n"),
+        ],
+        { timeout: SETUP_OPERATION_BUDGET_MS }
+      );
     } else if (CHECKSUMMED.has(entry.kind)) {
       // The pinned, checksummed path belongs to the remote-env installer. It is
       // borrowed rather than reimplemented so the pins and checksums cannot

package/plugins/lisa/skills/lisa-sonarcloud-access/SKILL.md

@@ -63,9 +63,9 @@ read_sonar_secret() {
   local name="$1"
   [ -n "${!name:-}" ] && { echo "${!name}"; return; }
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -74,12 +74,9 @@ read_sonar_secret() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -98,7 +95,7 @@ read_sonar_secret() {
       local via_lisa
       via_lisa=$(node "$resolver" get "$name" 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Name every path. A bare `return 1` sends the next reader hunting for a

package/plugins/lisa/skills/lisa-tracker-sync/SKILL.md

@@ -58,7 +58,7 @@ The state machine (first match wins, evaluated over the **required** leaves only
 | else any leaf has **started** (claimed or in review, or shipped while a sibling has not) | active / in-progress | `claimed` (or `review` where supported) |
 | else (leaves exist, none started) | unchanged | — |
 
-- **Blocked dominates** — one blocked leaf surfaces blocked on the parent even while others progress. It never says *which* child or *which kind* of hold; run `scripts/rollup-blocker-classification.mjs` over the resolved child graph and carry its per-class report — blocking leaf, path, and who must act — into the rollup note. A non-zero exit means it classified nothing; that is a failure to report, never an all-clear. See `leaf-only-lifecycle` → **Classifying a hold**.
+- **Blocked dominates** — one blocked leaf surfaces blocked on the parent even while others progress. It never says *which* child or *which kind* of hold. Resolve the shared classifier from `${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/rollup-blocker-classification.mjs` (the current-directory fallback supports a Lisa checkout), run it over the resolved child graph, and carry its per-class report — blocking leaf, path, and who must act — into the rollup note. A missing classifier or non-zero exit is a strict **no-write** result for every vendor: no lifecycle mutation and no rollup-comment mutation. Report the failure, never an all-clear. See `leaf-only-lifecycle` → **Classifying a hold**.
 - **Least-advanced env wins** — a parent reaches an env only once all required leaves have reached at least that env (all `On Stg` → `On Stg`; mixed dev/staging → the dev value). Native terminal closure fires only at the production `done`, never at an intermediate env.
 - **The parent never carries `ready`** — `ready` is a human "claim this leaf" signal; rollup only moves a parent between non-ready container states.
 - **Rollup is recursive** — an Epic rolls up from its Stories, each of which rolls up from its own leaves. Evaluate bottom-up.

package/plugins/lisa-agy/hooks/parity-safety-net.sh

@@ -1064,8 +1064,38 @@ readonly AGENT_CREDENTIAL='(\.(claude|codex|cursor|copilot|gemini|antigravity)/[
 # 15d. Dotenv files. `.env.example`, `.sample`, `.template`, `.dist` and
 # `.schema` are checked-in documentation of which keys exist, never the values,
 # so they are excluded — that collision is the one this rule most had to avoid.
-readonly DOTENV_SECRET='(^|[[:space:]='"$qc"'./])\.env(\.[[:alnum:]_-]+)?([[:space:]'"$qc"']|$)'
-readonly DOTENV_PUBLIC='\.env\.(example|sample|template|dist|schema|defaults)([[:space:]'"$qc"']|$)'
+# Decide dotenv privacy per PATH, never by subtracting one command-wide match
+# from another. A command that names `.env.example` and `.env` contains both a
+# public path and a private one; seeing the former cannot authorize the latter.
+#
+# The one write-only shape this guard has always allowed remains explicit:
+# seeding a private dotenv destination from one public template. This is safe
+# because the private path is the destination, not a value being read back.
+has_private_dotenv_path() {
+  dotenv_scan_status=0
+  dotenv_candidates="$(printf '%s' "$normalized_command_str" \
+    | grep -Eio -- '(^|[[:space:]='"$qc"'./])\.env(\.[[:alnum:]_-]+)?')" \
+    || dotenv_scan_status=$?
+  if [ "$dotenv_scan_status" -gt 1 ]; then
+    block "dotenv path classification failed; denying the credential-store read fail-closed."
+  fi
+
+  while IFS= read -r candidate; do
+    [ -n "$candidate" ] || continue
+    candidate="$(printf '%s' "$candidate" \
+      | tr '[:upper:]' '[:lower:]' \
+      | grep -Eo -- '\.env(\.[[:alnum:]_-]+)?')"
+    case "$candidate" in
+      .env.example | .env.sample | .env.template | .env.dist | .env.schema | .env.defaults) ;;
+      *) return 0 ;;
+    esac
+  done <<EOF
+$dotenv_candidates
+EOF
+  return 1
+}
+
+readonly SAFE_DOTENV_SEED='^[[:space:]]*(cp|mv)[[:space:]]+\.env\.(example|sample|template|dist|schema|defaults)[[:space:]]+\.env(\.[[:alnum:]_-]+)?[[:space:]]*$'
 
 if matches "$SECRET_READ_VERB"; then
   if matches "$SSH_PRIVATE_KEY"; then
@@ -1077,10 +1107,10 @@ if matches "$SECRET_READ_VERB"; then
   if matches "$AGENT_CREDENTIAL"; then
     block "reading, copying or transmitting a coding-agent or package-registry credential store. These tokens impersonate the operator to every service the agent can reach."
   fi
-  # `.env` only when the path is NOT one of the public example forms. Ordered as
-  # an exclusion rather than a narrower pattern so a new example suffix is one
-  # word to add, and so the reason a file is exempt stays readable.
-  if matches "$DOTENV_SECRET" && ! matches "$DOTENV_PUBLIC"; then
+  # A public path elsewhere in the command never exempts a private path. The
+  # narrow public-template -> private-destination seed is write-only and remains
+  # allowed; every other command containing a private dotenv path is refused.
+  if has_private_dotenv_path && ! matches "$SAFE_DOTENV_SEED"; then
     block "reading, copying or transmitting a dotenv file holding real values. \`.env.example\`, \`.env.sample\`, \`.env.template\` and \`.env.dist\` are readable, and WRITING a .env is unaffected — only reading one back is refused."
   fi
   # Fail-closed, narrowly. A read whose DIRECTORY is a known credential store

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.22.9",
+  "version": "4.22.10",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/scripts/install-remote-agent-aws.mjs

@@ -329,12 +329,16 @@ the complete bundle from the shared account. Do not extract or distribute its
 individual access-key fields:
 
 \`\`\`bash
-aws --profile shared secretsmanager get-secret-value \\
+aws secretsmanager get-secret-value \\
   --secret-id ${secretName} \\
   --query SecretString \\
   --output text
 \`\`\`
 
+This uses the ambient AWS identity. Add \`--profile <source-profile>\` only when
+this project requires a named source profile to read the emission; \`shared\` is
+not an implicit requirement.
+
 Store that exact output as the masked secret \`LISA_AWS_BOOTSTRAP_JSON\` on each
 remote-agent platform. Run the setup command and require its live
 \`sts:GetCallerIdentity\` check to pass before considering the platform ready.