@codyswann/lisa 4.29.1 → 4.29.3

package/package.json

@@ -147,6 +147,7 @@
       "js-yaml": "^3.15.1"
     },
     "axios": ">=1.15.2",
+    "browserslist": ">=4.28.8",
     "deepmerge-ts": "^8.0.1",
     "esbuild": ">=0.28.1",
     "eslint-plugin-react-hooks": "^7.0.0",
@@ -163,7 +164,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.29.1",
+  "version": "4.29.3",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -311,6 +312,6 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "9c8f3675158687abd73d0ffb61aa00fad3b9befb",
-  "gitHead": "9c8f3675158687abd73d0ffb61aa00fad3b9befb"
+  "lisaReleaseCommit": "86cd76f9dbd28c1ded3ae247c3cbce68af74ac1a",
+  "gitHead": "86cd76f9dbd28c1ded3ae247c3cbce68af74ac1a"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.29.1",
+  "version": "4.29.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.29.1",
+  "version": "4.29.3",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/SKILL.md

@@ -73,6 +73,61 @@ ${XDG_CONFIG_HOME:-$HOME/.config}/<secrets.namespace>/     # dir 0700
 - Each temporary file is created **beside its destination**, because a rename is only atomic within one filesystem.
 - The writer and the parser for `secrets.env` live in one module (`envfile.mjs`) on purpose. A shell sources the file, and the resolver reads it back; if the quoting and the parsing drift apart, every value containing a quote is corrupted silently.
 
+## Everything written outside that directory is owned
+
+Materialization also writes to paths with **no tenant in them** — `~/.aws/config`, `~/.aws/credentials`, `~/.bashrc`, `~/.profile`. Two projects on one machine therefore wrote the same identifiers, and the second silently replaced the first. Measured with two bundles declaring the same stage names: two profiles survived where four were written, the surviving `agent-dev` named the second project's account, and every shell on the machine sourced the second project's values. Both runs exited 0.
+
+Nothing about the surviving profile is malformed — it is a real, working profile that belongs to someone else — so no property check on the profile can detect it. Only a comparison against the intended owner fires.
+
+**The owner is `secrets.namespace`.** It already scopes `~/.config/<namespace>`, so two repositories of one tenant share and two tenants do not. Nothing is written without one.
+
+| Identifier | How it is protected |
+| --- | --- |
+| `~/.aws` profile names | Prefixed: `<namespace>-<stage>` (`<namespace>-lisa-bootstrap` for the source profile). Distinct names make a wrong resolution impossible, matching the convention `lisa-setup-remote-aws` writes. |
+| `~/.aws` managed block | Tagged `owner=<namespace>`. Only this owner's block is replaced; another project's is left untouched. |
+| Shell profile block | Tagged the same way, but it **cannot** be namespaced — it exports into every shell and there is no name a consumer selects. So it is claimed only when unowned or already ours; a block held by another project stops the run and names it. `LISA_SECRETS_CLAIM_SHELL_PROFILE=1` takes it over deliberately. |
+
+**Blocks written before ownership existed** are attributed rather than assumed, because leaving an orphan behind is its own defect — an orphaned shell block is still sourced, and the last assignment wins.
+
+- A legacy **shell** block names `<config root>/<tenant>/secrets.env` in its body, so it states its own owner: ours is replaced in place, another tenant's stops the run.
+- A legacy **`~/.aws`** block carries no such tell, so it is attributed by the accounts in its role ARNs. Matching this bundle's accounts means it is our own past output and is replaced; anything else is reported by name on every run and removed only under `LISA_SECRETS_PRUNE_LEGACY_PROFILES=1`.
+
+A stage may declare `expectedAccountId`. This writer never contacts AWS, so it cannot compare against a live `sts:GetCallerIdentity` the way `lisa-setup-remote-aws` does — but a declaration contradicting the account in its own role ARN is caught before anything is written.
+
+### Emit vs resolve — the bare names still RESOLVE, and are never EMITTED
+
+Two different guarantees, with two different expiry conditions. Conflating them is how a temporary shim becomes permanent by accident.
+
+| | Guarantee | Shape | Expires |
+| --- | --- | --- | --- |
+| **Emit** | what this writer produces as canonical output | `<namespace>-<stage>`, assuming from `<namespace>-lisa-bootstrap` | never |
+| **Resolve** | names that must keep working for *readers* mid-migration | the above, **plus** the deprecated bare `<stage>` family | when no caller resolves the bare names |
+
+Generators outside this repository emit the bare `<stage>` family and the bare `lisa-bootstrap` source profile independently, and scripts and documentation in caller repositories name them directly. Nothing co-ordinates a rename across those repositories, so emitting only the owned names would leave writer and reader disagreeing: a bare `[profile <stage>]` whose `source_profile = lisa-bootstrap` would point at a section that no longer exists, and every call through it would fail to resolve.
+
+So the bare names are written as **deprecated aliases beside** the canonical output — never as canonical output — from one bundle in one pass, inside the same owner-tagged block:
+
+```ini
+[profile <namespace>-<stage>]      # EMITTED — canonical output
+source_profile = <namespace>-lisa-bootstrap
+
+[profile <stage>]                  # RESOLVE-ONLY, DEPRECATED — an alias
+source_profile = lisa-bootstrap    # same role, external id and region
+```
+
+Nothing in the canonical body ever names the bare source profile, so canonical output does not depend on the deprecated half resolving. `emitSourceProfileFor()` is the only thing that names a source profile in canonical output; `RESOLVE_ONLY_LEGACY_SOURCE_PROFILE` is used by the resolve path alone — not to attribute a block either, since ownership comes from the `owner=` marker and a pre-ownership block is attributed by the accounts in its role ARNs.
+
+**The resolve window is not a fix.** The bare family is a *single shared slot* on a machine that may serve several projects — the exact collision the owned names remove. On the resolve path that collision is unfixed:
+
+- claimed when nothing else holds them, or when they are already this project's;
+- refused **as a set** when another project or an operator's own section holds any part of them — a half-written family whose source profile belongs to someone else resolves into that project's account;
+- reported by name on every run when refused, because a caller that has not migrated still uses those names and would otherwise get another project's account while reporting success;
+- `LISA_SECRETS_CLAIM_LEGACY_PROFILES=1` takes them deliberately.
+
+The emitted names are always written and always correct; refusing an alias never withholds them. The bare names are correct for at most one project per machine.
+
+**Removal condition, stated against the resolve path** — the only half that expires. Delete the resolve-only half once nothing outside this repository *resolves* the bare family, i.e. no caller names `<stage>` or `lisa-bootstrap` when selecting a profile. A caller proves it by selecting only `<namespace>-<stage>`; `LISA_SECRETS_NO_LEGACY_PROFILES=1` opts one out ahead of the removal and takes the isolation immediately. The emit path is unaffected by that deletion, because it never used the deprecated name.
+
 ## Configuration
 
 ```json

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/aws-bootstrap.mjs

@@ -28,6 +28,8 @@
  * @module aws-bootstrap
  */
 
+import { assertOwner } from "./owner.mjs";
+
 /** The names every AWS SDK and the CLI actually read. */
 const ACCESS_KEY = "AWS_ACCESS_KEY_ID";
 const SECRET_KEY = "AWS_SECRET_ACCESS_KEY";
@@ -40,13 +42,93 @@ const PROFILE = "AWS_PROFILE";
 export const BOOTSTRAP_KEY = "LISA_AWS_BOOTSTRAP_JSON";
 
 /**
- * The profile that holds the bootstrap key pair and is assumed FROM.
+ * EMIT vs RESOLVE — read this before touching either name below.
+ *
+ * These are two different guarantees, they expire on two different conditions,
+ * and conflating them is how a temporary shim becomes permanent by accident.
+ *
+ * **EMIT** is what this writer produces as its canonical output. Exactly one
+ * shape is ever emitted as canonical: `<owner>-<stage>`, assuming from
+ * `<owner>-lisa-bootstrap`. That is the fix for the cross-project collision and
+ * it has no expiry.
+ *
+ * **RESOLVE** is the wider set of names that must keep working for READERS
+ * during a migration. It currently includes the bare `<stage>` family, which
+ * this writer emits only as a deprecated alias beside the canonical output —
+ * never as canonical output itself.
+ *
+ * A reader who mistakes the second for the first will conclude that Lisa still
+ * emits bare names and that the rename never happened. It did: every canonical
+ * name is owned, and `emitSourceProfileFor` is the only thing that names a
+ * source profile in canonical output.
+ */
+
+/**
+ * The tail of the EMITTED profile that holds the key pair and is assumed FROM.
  *
  * Named rather than `default` so it can never be picked up by accident: this
  * identity can assume roles and do nothing else, so a call that silently ran as
  * it would fail with a permissions error far from its cause.
+ *
+ * A SUFFIX rather than the whole name, because one fixed name is one shared
+ * slot. Two tenants on a workstation both wrote `[lisa-bootstrap]`, so the
+ * second run's key pair replaced the first's and the first tenant's profiles
+ * then assumed their roles from the second tenant's identity — which either
+ * fails confusingly or, where a trust policy is permissive, succeeds.
  */
-export const SOURCE_PROFILE = "lisa-bootstrap";
+export const EMITTED_SOURCE_PROFILE_SUFFIX = "lisa-bootstrap";
+
+/**
+ * A name kept RESOLVING for unmigrated readers. Never emitted as canonical.
+ * **DEPRECATED — this constant exists only to be deleted.**
+ *
+ * Generators outside this repository emit the bare `<stage>` profile family and
+ * this bare source profile independently, and scripts and documentation in
+ * caller repositories name them directly. Nothing co-ordinates a rename across
+ * those repositories, so switching this writer to the owned names alone would
+ * leave writer and reader disagreeing: a bare `[profile <stage>]` whose
+ * `source_profile = lisa-bootstrap` would point at a section that no longer
+ * exists, and every call through it would fail to resolve.
+ *
+ * So the owned names are EMITTED as canonical and these bare names are kept
+ * RESOLVING beside them, both generated from one bundle in one pass. This
+ * constant is never used to decide what canonical output looks like, and it is
+ * not used to attribute a block either — ownership is read from the `owner=`
+ * marker tag, and a pre-ownership block is attributed by the accounts in its
+ * role ARNs. Its only job is the resolve path.
+ *
+ * **The window is not a fix, and this comment must not read like one.** The
+ * bare family is a single shared slot on a machine that may serve several
+ * projects — which is precisely the collision the owned names remove. During
+ * the window that collision is unfixed ON THE RESOLVE PATH ONLY: these names
+ * are claimed when unclaimed or already ours, and refused by name when another
+ * project holds them, so the failure is loud rather than silent, but two
+ * projects still cannot both have them. The emitted names are always correct;
+ * these are correct for at most one project per machine.
+ *
+ * **Removal condition — stated against the RESOLVE path, because that is the
+ * only thing that expires.** Delete this constant and every use of it once no
+ * caller repository *resolves* the bare family: that is, once nothing outside
+ * this repository names `<stage>` or `lisa-bootstrap` when selecting a profile.
+ * A caller proves it no longer resolves them by selecting only
+ * `<namespace>-<stage>`; `LISA_SECRETS_NO_LEGACY_PROFILES=1` lets one opt out
+ * ahead of the removal and take the isolation immediately. Nothing about the
+ * emit path changes when this is deleted, because the emit path never used it.
+ */
+export const RESOLVE_ONLY_LEGACY_SOURCE_PROFILE = EMITTED_SOURCE_PROFILE_SUFFIX;
+
+/**
+ * The source profile this writer EMITS for one owner, as canonical output.
+ *
+ * The only function that names a source profile in canonical output. If a
+ * canonical section ever assumes from something this did not return, the emit
+ * path has regressed.
+ * @param {string} owner Validated owner.
+ * @returns {string} The owner's emitted source-profile name.
+ */
+export function emitSourceProfileFor(owner) {
+  return `${owner}-${EMITTED_SOURCE_PROFILE_SUFFIX}`;
+}
 
 /**
  * Read the bundle's `profiles`, which may be an object OR a JSON string.
@@ -86,11 +168,27 @@ export function readProfiles(bundle) {
  * environment credentials OUTRANK `AWS_PROFILE`, so a session that exports them
  * ignores whichever profile it selects — the profiles would exist and never be
  * used.
+ *
+ * Every name is prefixed with the OWNER. The bundle's keys name a stage and
+ * nothing else, and the kit deliberately keeps role names identical across
+ * accounts so profiles differ only by account id — correct within one tenant,
+ * and the removal of the only distinguishing feature across two. Prefixing
+ * makes the wrong resolution impossible rather than merely detectable, which is
+ * the same fix #3440 applied to the sibling remote-agent writer; a workstation
+ * carrying both now sees one convention instead of two.
+ *
+ * The `resolveOnly` half is rendered SEPARATELY, and returned rather than merged,
+ * so
+ * the installer can drop it as a unit after looking at the filesystem — which
+ * this function deliberately cannot see. See `RESOLVE_ONLY_LEGACY_SOURCE_PROFILE` for why
+ * that half exists at all and when it goes away.
  * @param {object} bundle Parsed bootstrap bundle.
- * @returns {{credentials: string, config: string, profiles: string[]}|null}
- *   Rendered file contents and the profile names, or null when unusable.
+ * @param {string} owner Tenant these profiles belong to.
+ * @returns {{credentials: string, config: string, profiles: string[], resolveOnly: {credentials: string, config: string, profiles: string[], sourceProfile: string}}|null}
+ *   Rendered file contents, the profile names, and the deprecated
+ *   bare-named half; or null when the bundle is unusable.
  */
-export function renderAwsProfiles(bundle) {
+export function renderAwsProfiles(bundle, owner) {
   if (!bundle) return null;
 
   const accessKeyId = bundle.accessKeyId ?? bundle.aws_access_key_id;
@@ -98,10 +196,15 @@ export function renderAwsProfiles(bundle) {
     bundle.secretAccessKey ?? bundle.aws_secret_access_key;
   if (!accessKeyId || !secretAccessKey) return null;
 
+  // Checked AFTER the bundle is known usable, so a surface with no bundle at
+  // all still returns null rather than failing over a missing owner it was
+  // never going to use.
+  const scope = assertOwner(owner, "~/.aws");
+  const sourceProfile = emitSourceProfileFor(scope);
   const profiles = readProfiles(bundle);
 
   const credentials = [
-    `[${SOURCE_PROFILE}]`,
+    `[${sourceProfile}]`,
     `aws_access_key_id = ${accessKeyId}`,
     `aws_secret_access_key = ${secretAccessKey}`,
     "",
@@ -109,28 +212,105 @@ export function renderAwsProfiles(bundle) {
 
   const sections = [];
   const names = [];
-  for (const [name, entry] of Object.entries(profiles)) {
+  const resolveOnlySections = [];
+  const resolveOnlyNames = [];
+  for (const [stage, entry] of Object.entries(profiles)) {
     const roleArn = entry?.roleArn ?? entry?.role_arn;
     if (!roleArn) continue;
 
+    assertDeclaredAccount(stage, entry, roleArn);
+
+    const name = `${scope}-${stage}`;
     // A name is only usable if it can be written as an ini section header and
     // read back as the same string. Anything with a bracket or newline would
     // either truncate or inject extra lines into ~/.aws/config, and a config
-    // file this corrupts is worse than one it never wrote.
+    // file this corrupts is worse than one it never wrote. Checked on the FULL
+    // name, since that is the string that becomes the header.
     if (!/^[\w.@-]+$/.test(name)) continue;
 
-    const lines = [`[profile ${name}]`, `role_arn = ${roleArn}`];
-    lines.push(`source_profile = ${SOURCE_PROFILE}`);
-    if (bundle.externalId) lines.push(`external_id = ${bundle.externalId}`);
-    if (entry.region) lines.push(`region = ${entry.region}`);
-    sections.push(`${lines.join("\n")}\n`);
+    sections.push(
+      `${profileSection(name, roleArn, sourceProfile, bundle, entry)}\n`
+    );
     // Collected here, where the name is already in scope. Recovering it by
     // re-parsing the rendered text made the header format load-bearing: a
     // change to it would silently corrupt every returned name.
     names.push(name);
+
+    // The deprecated twin, generated from the SAME bundle in the same pass.
+    // Regenerating both from one source is what makes them incapable of
+    // drifting apart; a hand-maintained second copy would be a new defect.
+    if (!/^[\w.@-]+$/.test(stage)) continue;
+    resolveOnlySections.push(
+      `${profileSection(stage, roleArn, RESOLVE_ONLY_LEGACY_SOURCE_PROFILE, bundle, entry)}\n`
+    );
+    resolveOnlyNames.push(stage);
   }
 
-  return { credentials, config: sections.join("\n"), profiles: names };
+  return {
+    credentials,
+    config: sections.join("\n"),
+    profiles: names,
+    resolveOnly: {
+      credentials: [
+        `[${RESOLVE_ONLY_LEGACY_SOURCE_PROFILE}]`,
+        `aws_access_key_id = ${accessKeyId}`,
+        `aws_secret_access_key = ${secretAccessKey}`,
+        "",
+      ].join("\n"),
+      config: resolveOnlySections.join("\n"),
+      profiles: resolveOnlyNames,
+      sourceProfile: RESOLVE_ONLY_LEGACY_SOURCE_PROFILE,
+    },
+  };
+}
+
+/**
+ * One `[profile …]` section.
+ *
+ * Shared by the canonical and the deprecated renderer so the two cannot differ
+ * in anything but their names — the resolve-only profile must reach the same
+ * role, with the same external id and region, or it is not a shim but a
+ * second, subtly different credential.
+ * @param {string} name Section name.
+ * @param {string} roleArn The role to assume.
+ * @param {string} sourceProfile The profile holding the key pair.
+ * @param {object} bundle The bundle, for `externalId`.
+ * @param {object} entry The stage entry, for `region`.
+ * @returns {string} The rendered section.
+ */
+function profileSection(name, roleArn, sourceProfile, bundle, entry) {
+  const lines = [`[profile ${name}]`, `role_arn = ${roleArn}`];
+  lines.push(`source_profile = ${sourceProfile}`);
+  if (bundle.externalId) lines.push(`external_id = ${bundle.externalId}`);
+  if (entry.region) lines.push(`region = ${entry.region}`);
+  return lines.join("\n");
+}
+
+/**
+ * Refuse a stage whose declared account contradicts its own role ARN.
+ *
+ * This writer never contacts AWS — it runs during container setup, before a
+ * task exists and often before network policy would allow the call — so the
+ * live `sts:GetCallerIdentity` comparison #3440 added is not available here.
+ * What IS available is the bundle's own statement about itself: a stage may
+ * declare `expectedAccountId`, and a declaration that disagrees with the
+ * account embedded in the role ARN is a bundle that cannot be right either way.
+ * Catching it before the write costs nothing and is the only identity assertion
+ * this surface can make offline.
+ * @param {string} stage The bundle key.
+ * @param {object} entry The stage's entry.
+ * @param {string} roleArn The role ARN about to be written.
+ */
+function assertDeclaredAccount(stage, entry, roleArn) {
+  const declared = entry?.expectedAccountId;
+  if (!declared) return;
+  const inArn = String(roleArn).split(":")[4];
+  if (String(declared) === inArn) return;
+  throw new Error(
+    `bootstrap stage "${stage}" declares expectedAccountId ${declared}, but ` +
+      `its roleArn names account ${inArn}. Refusing to write a profile whose ` +
+      `own bundle contradicts itself; nothing was changed.`
+  );
 }
 
 /**
@@ -157,10 +337,16 @@ export function parseBootstrap(raw) {
  *
  * Returns only additions; the caller merges. Nothing here mutates its input,
  * so a caller can decide what to do with the result — including reporting it.
+ * Takes the owner for one reason: `AWS_PROFILE` must name a profile that was
+ * actually written. Prefixing the written names without prefixing the derived
+ * selection would set `AWS_PROFILE=agent-dev` against a config that now defines
+ * `acme-agent-dev`, reintroducing the "profile not found" failure this module
+ * exists to remove.
  * @param {Map<string, {value: string}>} selected Secrets by exact name.
+ * @param {string} owner Tenant these secrets belong to.
  * @returns {Map<string, {value: string, note: string}>} Derived variables.
  */
-export function deriveAwsEnvironment(selected) {
+export function deriveAwsEnvironment(selected, owner) {
   const derived = new Map();
   const bundle = parseBootstrap(selected.get(BOOTSTRAP_KEY)?.value);
   if (!bundle) return derived;
@@ -195,7 +381,7 @@ export function deriveAwsEnvironment(selected) {
   // that ~/.aws/config never contains — an entry with no roleArn, or a name too
   // exotic to be an ini header — fails with "profile not found", which is the
   // exact failure this whole change removes.
-  const names = renderAwsProfiles(bundle)?.profiles ?? [];
+  const names = renderAwsProfiles(bundle, owner)?.profiles ?? [];
 
   // No usable profiles is not a reason to hand back a session with NOTHING.
   //