@codyswann/lisa 4.31.1 → 4.32.0

package/plugins/src/base/hooks/inject-resolved-config.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# SessionStart / SubagentStart: put the RESOLVED Lisa configuration in front of
+# the agent, so reading it is not a decision anyone can decline to make.
+#
+# `inject-rules.sh` beside this file injects RULE TEXT. Nothing injected the
+# resolved VALUES, so an agent received a paragraph saying that configuration
+# lives in a file and then had to decide, unprompted, to go read it. That
+# decision is the step that gets skipped, and it is why projects keep "missing"
+# a `.lisa.config.json` that is present and correct. An agent cannot skip
+# reading what is already in its context.
+#
+# All the work — resolving `.lisa.config.local.json` over `.lisa.config.json`,
+# marking built-in defaults, redacting identity, bounding the output — lives in
+# the sibling `.mjs`, which is unit-tested. This wrapper only resolves the
+# project root and hands stdin through.
+#
+# FAIL SOFT, ALWAYS. Every exit is 0 and every failure is silent. The right
+# response to "node is missing" or "the renderer crashed" is a session that
+# starts without this block, never a session that does not start. The hard
+# reading of the same config lives where it can afford to be hard: the gate
+# runner refuses a config it cannot read, and `lisa doctor` exits non-zero.
+#
+# Note the ONE case that is emphatically not silent: a config that exists and
+# is malformed emits a block saying so. Staying quiet there would report a
+# broken project as an unconfigured one, which is the invisible-gap failure
+# this hook exists to remove.
+set -uo pipefail
+
+INPUT=$(cat 2>/dev/null || true)
+
+ROOT="${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}}"
+RENDERER="$ROOT/hooks/inject-resolved-config.mjs"
+
+[ -f "$RENDERER" ] || exit 0
+command -v node >/dev/null 2>&1 || exit 0
+
+# CLAUDE_PROJECT_DIR is the harness's own declaration of the root and is the
+# only source that stays correct when the session's cwd has moved. Falling back
+# to the git toplevel before $PWD matters for the same reason: config lives at
+# the repo root, and a hook that reads the cwd reports "unconfigured" from any
+# subdirectory (the defect fixed for setup-jira-cli in CodySwannGT/lisa#2768).
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-}"
+if [ -z "${PROJECT_DIR}" ] || [ ! -d "${PROJECT_DIR}" ]; then
+  PROJECT_DIR="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+fi
+
+printf '%s' "$INPUT" | node "$RENDERER" --project-dir "$PROJECT_DIR" || true
+exit 0

package/plugins/src/base/rules/eager/config-resolution.md

@@ -1,6 +1,13 @@
 # Config Resolution (load-bearing)
 
-Lisa configuration lives in `.lisa.config.json` (committed) and `.lisa.config.local.json` (gitignored, per-developer). The local file wins where they overlap. Developer-specific identity (`atlassian.email`, etc.) MUST live in the local file, never committed.
+**The resolved configuration is already in your context.** `inject-resolved-config.sh` runs at every session and subagent start and injects the EFFECTIVE values — `.lisa.config.local.json` already merged over `.lisa.config.json` — inside a `<lisa-resolved-config>` block, marking anything that is a Lisa built-in rather than something this project declared. Read the values there and act on them; do not re-derive them from the files, and do not act against them.
+
+That block replaces the paragraph that used to sit here saying where configuration lives and which file wins. Restating it is what nine eager rules were already doing while agents acted against a config they never opened; if the block is ever missing, the two files are the source and the local one wins where they overlap.
+
+Two things the block deliberately does not carry, so they stay here:
+
+- **Writing identity.** Developer-specific identity (`atlassian.email`, etc.) MUST go in the local file, never the committed one. The injected block omits identity entirely, so it will never show you that this is broken.
+- **Everything below**, which is behaviour keyed off config rather than the values themselves.
 
 ## Atlassian access — assistant-level rule
 

package/scripts/lib/per-agent-hook-filter.mjs

@@ -102,6 +102,26 @@ const SCRIPT_RULES = {
     agy: false, // no full rules tree on agy; AGENTS.md carries only bounded bridges
     copilot: true, // conservative default; conditionally stripped if rules-auto-load probe positive
   },
+  // Ships wherever the agent has a session-start event, on the same reasoning
+  // as `secrets-preflight.sh` and NOT on `inject-rules.sh`'s. Cursor strips
+  // rule injection because rules are also delivered as native `rules/*.mdc`, so
+  // injecting would double-deliver; a RESOLVED CONFIG has no second delivery
+  // path on any agent — it is computed per session from two files on disk and
+  // is never emitted as a static artifact — so that reason does not transfer
+  // and Cursor gets it.
+  //
+  // Documented gap: agy has no SessionStart event at all, so agy sessions get
+  // no injected config. The compensating rung is the same one AGENTS.md
+  // requires when a harness cannot represent a control — shared rather than
+  // agent-layer: the gate runner refuses a config it cannot read, and
+  // `lisa doctor` exits non-zero on a broken one, on every agent.
+  "inject-resolved-config.sh": {
+    claude: true,
+    codex: true,
+    cursor: true,
+    agy: false,
+    copilot: true,
+  },
   "inject-flow-context.sh": {
     claude: true,
     codex: true,